Skip to main content
Category: Hacks → Malware, Fake Wallets & Device CompromiseHacksMalwareBrowser ExtensionsReading time: 9 minutes
Risk level: High
Target audience: Browser users, DeFi users

​
Meet Ngozi

Ngozi uses Chrome and frequently trades on DEXs. She sees an ad for “Gas Fee Optimizer” — an extension that supposedly reduces Ethereum gas fees. She installs it from the Chrome Web Store. The extension works for a few days, seeming to help with gas optimization. Then, one day, her MetaMask is drained.

​
What Happened

​
Step 1: The Malicious Extension

The “Gas Fee Optimizer” was a malicious extension that requested broad permissions:
  • “Access your data on all websites”
  • “Modify data you send to websites”
  • “Read your browser history”
Ngozi approved these permissions without reading them carefully (most users do).

​
Step 2: The Wallet Compromise

The extension, with its broad permissions, could:
  • Intercept MetaMask transactions.
  • Modify transaction data before sending.
  • Capture wallet data and seed phrases (if displayed).
  • Redirect wallet interactions to malicious sites.

​
Step 3: The Theft

The extension redirected Ngozi’s MetaMask requests to a fake wallet interface controlled by the attacker. When Ngozi logged into MetaMask, she was actually logging into a phishing site created by the extension. Her credentials were captured, and the attacker drained her wallet.

​
Where the Scammer Won

  • Broad permissions: The extension requested access to all websites, allowing it to intercept any data.
  • Legitimate-sounding purpose: “Gas Fee Optimizer” seemed useful and legitimate.
  • Chrome Web Store listing: Being on the official store made it seem trustworthy.
  • Silent operation: The extension worked normally while secretly intercepting data.

​
Red Flags Ngozi Missed

  • Extensions asking for broad permissions (“Access all websites,” “Modify data”).
  • Extensions from unknown developers.
  • Recent extensions (newly published or updated).
  • Too many permissions for stated purpose: A gas optimizer shouldn’t need access to all websites.

​
How Malicious Browser Extensions Work

What happens: Scammer creates extension with legitimate-sounding purpose, requests broad permissions.
What happens: Extension is submitted to Chrome Web Store, passes initial review.
What happens: User installs extension and grants broad permissions without reading carefully.
What happens: Extension intercepts wallet transactions, modifies data, or redirects to phishing sites.
What happens: Attacker captures credentials or modifies transactions to drain wallet.

​
Prevention

Only install extensions from trusted sources (major companies, GitHub projects with community backing).
Review permissions carefully. If an extension asks for “access to all websites,” question why it needs that.
Limit wallet access. Don’t use MetaMask on untrusted networks or with suspicious extensions.
Audit extensions regularly. Remove any you don’t actively use.
Check extension reviews: Look for warnings about data theft or suspicious behavior.

​
If You Already Installed a Malicious Extension

1

Remove Extension Immediately

Remove the extension from your browser immediately.
2

Change All Passwords

Change passwords for all accounts accessed while extension was installed.
3

Revoke Wallet Approvals

Use Revoke.cash to revoke any approvals made while extension was active.
4

Report the Extension

Report the extension to Chrome Web Store.
5

Monitor Accounts

Monitor all accounts for unauthorized activity.

Clipboard Hijacker

How clipboard malware steals wallet addresses

Hacks Category

Explore all types of malware and device compromise

Check Your Wallet

Verify if addresses are reported as malicious

​
References

  1. Chrome Web Store - How to Report Malicious Extensions
  2. Browser Extension Security Best Practices
  3. MetaMask - Extension Security Guidelines