Malicious Chrome and Firefox Extensions Steal Crypto Traders' Session and Wallet Data

Reported 10 Sep 2026 by otx · Severity: medium

Six Chrome and Firefox extensions linked through shared code, C2 infrastructure, and publishing history have been identified targeting cryptocurrency traders. Four malicious extensions steal authenticated session tokens and wallet data from Axiom Trade and Padre users, while two