Chrome extension compromise resulted in millions of theft
Trust Wallet recently disclosed that the Sha1-Hulur supply chain attack last year in November might be responsible for the compromise of its Google Chrome extension, causing $8.5 million assets theft.
About the incident
According to the company, its “developer GitHub secrets were exposed in the attack, which gave the attacker access to our browser extension source code and the Chrome Web Store (CWS) API key.” The attacker obtained full CWS API access via the leaked key, allowing builds to be uploaded directly without Trust Wallet’s standard release process, which requires internal approval/manual review.”
Later, the threat actor registered the domain “metrics-trustwallet[.]com” and deployed a malware variant of the extension with a backdoor that could harvest users’ wallet mnemonic phrases to the sub-domain “api.metrics-trustwallet[.]com.”
Attack tactic
According to Koi, a cybersecurity company, the infected code activates with each unlock causing sensitive data to be harvested. It doesn’t matter if the victims used biometrics or password, and if the wallet extension was opened once after the 2.68 version update or in use for months.
This article has been indexed from CySecurity News – Latest Information Security and Hacking Incidents