Hidden Thief: Solana Swap Extension Steals User Funds

A newly identified malicious Chrome extension is turning legitimate Solana trading into a covert heist. Dubbed Crypto Copilot, this extension masquerades as an easy way to trade on the Solana blockchain from Twitter, while secretly draining a portion of every transaction. Users’ wallets are targeted without their knowledge when Crypto Copilot adds a hidden transfer instruction during swaps, diverting funds directly into the attacker’s account.