Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses

Cybersecurity researchers have identified a browser extension campaign that steals cryptocurrency by replacing wallet addresses during transactions. This campaign, dubbed Silent Swap by McAfee Labs, operates by stealthily altering addresses when users initiate a transaction. The campaign is delivered through unsigned installers, which have been observed in both .NET and Golang variants. The extension disguises itself as a legitimate Google Notes extension to deceive users. The goal of the campaign is to intercept and alter cryptocurrency transactions for financial gain.