Malicious Chrome extension “Safery: Ethereum Wallet” disguises as ETH wallet to steal users’ mnemonic phrases

According to ChainCatcher, as disclosed by the GoPlus Chinese community, a malicious Chrome extension named “Safery: Ethereum Wallet” has been discovered stealing users’ assets. The extension was released on November 12, 2024, disguising itself as a simple and secure Ethereum wallet, but it contains a built-in backdoor program.

The attack method is highly covert: the malicious extension encodes users’ mnemonic phrases as Sui addresses and steals the mnemonic by broadcasting micro-transactions from a Sui wallet controlled by the attacker. Currently, this malicious extension has not yet been removed from the Chrome Web Store.