SlowMist reveals phishing activities involving fake Chrome extensions that can steal mnemonic phrases, private keys, and other wallet credentials

According to SlowMist, its security monitoring system MistEye has discovered a counterfeit Chrome MV3 extension that launches a dual-layer phishing attack targeting TRON wallet users.

This extension disguises itself as an official plugin through Unicode obfuscation and brand impersonation. After installation, it prioritizes loading a remote iframe pop-up page, enticing users to input their mnemonic phrases, private keys, keystore files, and passwords, and transmits this information through a same-origin interface to a Telegram Bot. The malicious infrastructure involved includes tronfind-api[.]tronfindexplorer[.]com and trx-scan-explorer[.]org, with the malicious extension ID being ekjidonhjmneoompmjbjofpjmhklpjdd. SlowMist advises users to uninstall this extension immediately, and if sensitive information has been submitted, they should migrate their assets as soon as possible and discontinue use of the original wallet.