Fake “Google Notes” Browser Extension Caught Swapping Crypto Wallet Addresses
Fake 'Google Notes' browser extension swaps crypto wallet addresses in clipboard on Chrome, Brave, and Edge.
McAfee researchers discovered a malicious browser extension disguised as 'Google Notes' that intercepts and replaces cryptocurrency wallet addresses copied to the clipboard, a technique known as clipper malware. The extension uses unsigned installers to inject itself into Chromium-based browsers (Chrome, Brave, Microsoft Edge) and requests unusual permissions for a note-taking app, including clipboard and browsing history access. The campaign targets users across multiple cryptocurrencies including Bitcoin, Ethereum, Bitcoin Cash, Ripple, and Dash, with higher infection concentrations in India.
AI summary of the linked source. Not reviewed by an editor. How this works
Run McAfee?
Get an email when a new story names McAfee, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA malicious browser extension impersonating a legitimate Google product silently replaced cryptocurrency wallet addresses copied to the clipboard, redirecting funds to attacker-controlled wallets. The attack succeeded because users installed an unverified, unsigned extension from outside the official browser web store, granting it excessive permissions without scrutiny. This matters because clipper malware operates silently — victims only discover the theft after a transaction is irreversibly confirmed on the blockchain. It also highlights how supply chain impersonation (spoofing a trusted brand like Google) dramatically lowers user suspicion and raises the success rate of social engineering attacks.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — devops-offensive.cc
- domain — Zebregts.com
- malware — Google Notes clipper extension