# Malicious "Google Notes" Extension Steals Cryptocurrency by Swapping Wallet Addresses


Security researchers have uncovered a sophisticated browser extension scam that masquerades as Google Notes to intercept and redirect cryptocurrency transactions. The malware, dubbed "Silent Swap," silently replaces legitimate wallet addresses with attacker-controlled ones, enabling theft of cryptocurrency transfers without victim awareness.


## The Threat


The Silent Swap malware operates as a deceptive browser extension available through the Chrome Web Store and other extension marketplaces. Once installed, the extension lies dormant, monitoring clipboard operations and form interactions across cryptocurrency-related websites and services.


When a user copies a wallet address—typically a long, complex alphanumeric string used to receive cryptocurrency—or attempts to enter one manually, the extension intercepts the operation. Silently and without visual indication, it replaces the legitimate address with an attacker-controlled wallet address. The victim proceeds with their transaction, believing they're sending funds to the intended recipient, but the cryptocurrency instead flows directly to the attacker's wallet.


Key attack characteristics:


  • Zero visual indication — Users see no warning or notification that an address has been swapped
  • Broad platform coverage — Affects transactions across exchanges, DeFi platforms, and wallet services
  • Persistent operation — Remains active across browser sessions and tabs
  • Low-friction distribution — Deployed via official-looking app store listings

    • The attack is particularly insidious because it bypasses most security awareness. Users who double-check wallet addresses will still be compromised if they copy-paste rather than type; the malicious extension intercepts at the clipboard level, not the display level.


    ## Background and Context


    Browser extension malware has become an increasingly prevalent vector for financial theft. Unlike malware that requires system-level installation or elevated permissions, malicious extensions integrate seamlessly into the browsing experience and can request broad access to user data and interactions.


    The cryptocurrency ecosystem is a high-value target due to:


  • Irreversible transactions — Blockchain transfers cannot be reversed or recalled once confirmed
  • Pseudonymous accounts — Stolen funds are difficult to trace back to attacker identities
  • High transaction values — Crypto users often transfer large sums in single transactions
  • Growing mainstream adoption — More users with varying security sophistication are entering crypto markets

    • Previous campaigns have distributed fake MetaMask, Ledger, and Uniswap extensions with similar clipboard-replacement functionality. Silent Swap represents a refinement of this attack pattern, using the legitimacy of "Google Notes" to reduce suspicion during installation.


    ## How Silent Swap Works


    ### Installation and Obfuscation


    The extension is distributed through fake or compromised Chrome Web Store listings that closely mimic Google's official branding. The listing description typically claims the extension adds enhanced note-taking functionality to Google's suite or improves integration with Google services—a reasonable use case that reduces user skepticism.


    Upon installation, the extension requests permissions for:


  • Content scripts — Ability to inject code into all visited webpages
  • Clipboard access — Reading and writing clipboard data
  • Storage APIs — Persisting configuration and stolen data locally
  • Network access — Communicating with command-and-control servers

    • ### Runtime Behavior


    Once active, Silent Swap operates through several mechanisms:


    Clipboard monitoring: The extension establishes a listener on clipboard events. When a user copies any text, the extension examines whether it matches known wallet address patterns (typically 42-character Ethereum addresses, 34-character Bitcoin addresses, or other cryptocurrency formats).


    Address replacement: When a cryptocurrency address is detected, the extension immediately replaces it with a hardcoded or dynamically fetched attacker address from the C2 server. The replacement occurs silently—the user's clipboard now contains the malicious address instead of the one they intended to copy.


    Form hijacking: For manual entry scenarios, the extension monitors input fields on known cryptocurrency platforms and auto-fills detected address fields with attacker addresses, potentially overwriting legitimate user input.


    Data exfiltration: The extension logs all intercepted addresses, transaction amounts, and user metadata, sending this information to attacker infrastructure for analysis and targeting refinement.


    ## Technical Details and Indicators


    Security researchers identified Silent Swap through:


  • Decompiled extension code revealing clipboard monitoring logic
  • Network traffic analysis showing C2 communications to attacker infrastructure
  • Behavioral signatures matching known malicious extension patterns
  • User reports of missing funds despite correct recipient confirmation

    • Extension indicators of compromise:


  • Manifest permissions requesting unnecessary clipboard/storage access
  • Obfuscated JavaScript with encoded strings and function names
  • References to cryptocurrency address formats in decompiled code
  • Communication with non-Google IP addresses despite "Google Notes" branding

    • ## Implications for Cryptocurrency Users and Organizations


    ### Individual Risk


    Any user with this extension installed faces complete compromise of cryptocurrency holdings accessible from their browser. Even users who practice basic security hygiene—using hardware wallets, enabling 2FA, verifying addresses—remain vulnerable because the attack occurs at the clipboard level, below the user's visual verification.


    High-value targets include:


  • Active traders conducting frequent transactions
  • DeFi users moving tokens between platforms
  • Cold wallet owners performing periodic transfers
  • Business users managing company cryptocurrency reserves

    • ### Enterprise and Exchange Risk


    Cryptocurrency exchanges and DeFi platforms face indirect liability if their users suffer losses from browser extension malware. While not directly responsible for client-side malware, exchanges can:


  • Implement withdrawal address whitelisting to prevent transfers to new addresses
  • Require additional verification for large transactions
  • Educate users about extension risks
  • Monitor for patterns suggesting clipboard compromise

    • ### Broader Ecosystem Impact


    This attack pattern undermines user confidence in cryptocurrency adoption and reinforces the perception that self-custody requires technical expertise beyond most users' capability. It may drive users toward centralized custodians, counterintuitively increasing systemic risk concentration.


    ## Detection and Prevention


    ### For Users


    Immediate actions:


  • Audit installed extensions — Review all browser extensions, especially those installed recently or with unusual permissions
  • Remove suspicious extensions — Delete any extension that doesn't have clear, recent reviews or developer history
  • Verify extension source — Only install extensions from the official Chrome Web Store or Firefox Add-ons store; verify the developer is legitimate
  • Check Chrome store reviews — Look for warning comments about missing funds or wallet address changes

    • Ongoing protection:


  • Use hardware wallets — Keep cryptocurrency offline in hardware wallets (Ledger, Trezor) and only connect when necessary
  • Whitelist recipient addresses — Most exchanges and wallet services allow address whitelisting; use this to prevent unexpected transfers
  • Manual address entry — For high-value transactions, manually type the final digits of the recipient address rather than copy-pasting entirely
  • Browser profiles — Maintain separate browser profiles for cryptocurrency activities and general browsing
  • Browser isolation — Use virtualized browsers or dedicated machines for cryptocurrency transactions
  • Disable clipboard monitoring — Some browsers allow disabling clipboard access permissions globally

    • ### For Security Teams


  • Monitor extension deployment — Track suspicious extension installations via endpoint detection platforms
  • Analyze clipboard operations — Monitor for processes accessing clipboard data on cryptocurrency-related sites
  • Threat intelligence — Subscribe to feeds tracking malicious extension distribution
  • User education — Train staff on extension risks and verification practices

    • ## Recommendations


    For individual users: Review installed extensions immediately. Remove anything with broad permissions or unclear purpose. For active cryptocurrency users, consider hardware wallet migration to eliminate browser-based attack surface entirely. When installing extensions, verify recent reviews specifically mentioning the developer's legitimacy.


    For cryptocurrency platforms: Implement mandatory address whitelisting for withdrawals above threshold amounts. Consider requiring user confirmation for address changes within a time window. Educate users about clipboard-level attacks in onboarding and security documentation.


    For browser vendors: Tighten extension review processes to detect permission misuse patterns. Implement runtime monitoring to detect clipboard manipulation. Require explicit user confirmation for clipboard access before allowing extensions to read or modify clipboard data.


    For security researchers: Continue analyzing malicious extension distribution patterns. Share indicators of compromise (C2 IPs, extension IDs, code signatures) with browser vendors and security vendors to accelerate takedowns.


    ---


    ## HackWire Analysis


    Silent Swap represents a worrying maturation of clipboard-hijacking attacks from niche criminal operations to sophisticated, scalable campaigns. What makes this threat particularly dangerous is that it succeeds *because* cryptocurrency users believe they follow security best practices—they verify addresses visually before sending, not realizing the attack occurs invisibly at the clipboard level.


    This attack pattern exposes a fundamental mismatch between user education ("verify addresses before sending") and actual attack surface. The crypto community has invested heavily in teaching users to avoid phishing and impersonation, yet Silent Swap bypasses those defenses entirely by intercepting at the data layer rather than the presentation layer.


    The broader implication is troubling: as users become more security-aware, attackers shift tactics toward scenarios where awareness cannot help. Browser extension malware has the advantage of legitimate distribution channels—the Chrome Web Store—and legitimate-seeming use cases. A "Google Notes" extension is plausible enough that many users won't question it. This suggests the next wave of financial malware will increasingly abuse proximity to legitimate services rather than relying on social engineering alone.


    For defenders, the takeaway is clear: client-side threats require system-level solutions. User education alone is insufficient when the attack operates below the user's line of sight. Hardware wallet adoption, address whitelisting, and browser isolation become not optional security theater but essential practices for users with significant holdings.


    The broader crypto ecosystem should view this as a forcing function toward custody models and transaction patterns that don't require trusting a general-purpose browser with large sums. Until that shift occurs, clipboard-level malware will remain highly effective.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)