Blockchain security firm SlowMist has released a threat intelligence report detailing a malicious Chrome extension disguised as a TronLink wallet. According to Foresight News, the extension, identified by ID ekjidonhjmneoompmjbjofpjmhklpjdd, uses Unicode bidirectional control characters and Cyrillic letters to impersonate the TronLink brand name. It inherits high ratings from existing Chrome store extensions, showing over a million installations and a 4.5-star rating, to lower user suspicion.
The attack operates on two levels: the first involves a local malicious extension that, once installed, prioritizes loading a remote iframe as a pop-up interface, requesting minimal permissions to evade review. The second level consists of a remote phishing page hosted on the Vercel platform, which fully mimics the TronLink web wallet UI. It prompts users to input mnemonic phrases, private keys, and Keystore files, then sends these credentials to attackers via a Telegram Bot (chat_id: 8334454422). The phishing page includes visitor identification and blocking logic, disables right-click and developer tools, and redirects Russian-speaking users to another domain to avoid dynamic analysis by security researchers.
SlowMist advises users who have installed the extension to uninstall it immediately and clear local storage. If wallet credentials were entered on the extension or phishing page, users should create a new wallet on a trusted device and transfer assets. The malicious domains involved are tronfind-api[.]tronfindexplorer[.]com and trx-scan-explorer[.]org. The official TronLink extension ID is ibnejdfjmmkpcnlpebklmnkoeoihofec, which users can verify by comparing IDs.
Anais
