A security researcher says that an extension on Google Chrome called “Shitcoin Wallet” steals passwords and saves users’ private keys.

An extension running on Google Chrome has been discovered injecting JavaScript code on web pages to steal passwords and private keys from cryptocurrency wallets and cryptocurrency payment gateways.

The extension is called “Shitcoin Wallet” (Chrome extension ID: ckkgmccefffnbbalkmbbgebbojjogffn), and it was launched last month, exactly on December 9.

According to source The Shitcoin Wallet extension allows users to manage Ethereum (ETH) coins as well as ERC20-based tokens, which are usually issued by ICOs.

Users can install the Google Chrome extension and manage ETH coins and ERC20 tokens from within their browser, or they can install an app and software on their desktop (currently supports Windows), if they want to manage their money away from the browser.

Read:Ripple Acquires a Startup to Enter the World of Decentralized Finance (DeFi)

Thus, users are vulnerable to this malicious add-on on most platforms, whether from the browser or from the desktop.

Malicious add-on detection and breakdown:

Discover Security ResearcherHarry DenleyMyCrypto Security Manager, said that the extension contains malicious code.

According to Harry, the extension poses a danger to users in two ways.

Or not: Any funds (ETH and ERC20-based tokens) managed directly within the extension are at risk.

Harry says the extension sends the private keys of all wallets created or managed through its interface to a third-party website.

secondly: The extension also injects malicious JavaScript code when users switch to five well-known and popular crypto management platforms.

This code steals login credentials and private keys, which are data sent to erc20wallet.

According to a security analysis of the malicious code, the process is as follows:

Users install the Google Chrome extension

Google Chrome extension requests permission to inject JavaScript code on 77 websites [مدرج هنا].

When users navigate to any of these 77 sites, the extension loads an additional JS file and inserts it from: [.] tk/js/content_.js

Read:Binance is committed to closing its services in “Ontario” and will ban its citizens from creating new accounts

This JS file contains obfuscated code [للاطلاع عليها من هنا].

Read:Coinbase’s stock, represented by a cryptocurrency, jumps to $296 after its launch on the FTX platform

The code is activated in five locations: MyEtherWallet.com, Idex.Market, Binance.org, NeoTracker.io, Switcheo.exchange.

Once activated, the malicious JS code records the user’s login credentials, looks for private keys stored within the dashboards of the five services, and finally, sends the data to erc20wallet.tk.

Until recently, the extension was available for download through the official Chrome extension store, having been downloaded more than 625 times.

It is not clear whether the Shitcoin Wallet team is responsible for the malicious code, or whether the Google Chrome extension was hacked by a third party.

Read also:

The 5 most controversial scams in the history of the cryptocurrency market

Beware the Foin scam prevented investors from withdrawing their funds… Find out the details!