Fake Google Sheets Extension - Scammed | Last Update!

[PX-Z]

Today I decided to do a long-needed cleanup on the computer after more than half a year of being inactive. I started with a malware scan from Malwarebytes, and to my surprise, it still detected the fake extension! However, the extension was found on Microsoft Edge, something that completely slipped undetected because I generally use Chrome and never spotted it on Edge.

There is something weird about Microsoft Edge that I noticed. It seems to automatically install extensions that are already installed on Chrome. I saw this on my Windows PC

It will only be possible if the two browsers are sync using the same google account/email.

To OP, have you tried other browsers instead of chrome? I'm not a fan of it actually, Firefox is much better for me Check if the address is changing too after pasting it on the address textbox.
.

To OP, if you really think that the extension was installed through other unknown app/s without your AV detecting even after a full scan. I will also suggest to reformat or install a new OS to your device. It might be troublesome and time-consuming, but it's your last choice to get rid of the malware.

[Ultegra134]

Today I decided to do a long-needed cleanup on the computer after more than half a year of being inactive. I started with a malware scan from Malwarebytes, and to my surprise, it still detected the fake extension! However, the extension was found on Microsoft Edge, something that completely slipped undetected because I generally use Chrome and never spotted it on Edge.

There is something weird about Microsoft Edge that I noticed. It seems to automatically install extensions that are already installed on Chrome. I saw this on my Windows PC

It will only be possible if the two browsers are sync using the same google account/email.

To OP, have you tried other browsers instead of chrome? I'm not a fan of it actually, Firefox is much better for me Check if the address is changing too after pasting it on the address textbox.
.

To OP, if you really think that the extension was installed through other unknown app/s without your AV detecting even after a full scan. I will also suggest to reformat or install a new OS to your device. It might be troublesome and time-consuming, but it's your last choice to get rid of the malware.

No, the address is not changing when copy-pasting. The extension was displaying the hacker's address instead of the right deposit address; thus, you're practically handing over your coins to the hackers. The extension though wasn't probably installed for a long time, because its script was slowing down tabs and making them crash.

I'm going through a fresh Windows installation as we speak, even though my computer looks safe so far, as no antivirus can detect any kind of malware right now. I had used the Brave browser in the past; I don't know if it also had the extension installed, but it didn't suit me. It's not the browser's fault; it's just that I find Chrome more convenient due to the synchronizations through my Google account, which sync all the necessary data I'm using daily. On top of that, I use their services, such as Google Drive, Gmail, Photos, etc., on a daily basis.

Before the automation of Google services and the Chrome browser, I used to use Firefox and preferred it as a browser overall; it was also a lot lighter than Chrome.

[logfiles]

I'm going through a fresh Windows installation as we speak, even though my computer looks safe so far, as no antivirus can detect any kind of malware right now.

If you can, install Linux OS as well on your PC and use it only to install wallets, performing transactions and maybe trading.

There are fewer chances of picking up malware via Linux unless if one is way too careless. I have mine and I have never ever felt unsafe like I do when using Windows even though I have not many random apps installed in it.
Antivirus software programs are just bullshit and can give you a false sense of security.

[blckhawk]

awareness is the key when transacting, you have to not only double check but triple check on addresses, we never know if we have this, even if we have these popular antiviruses.

Antiviruses is easily bypassed if the scammer/hacker is good enough at creating a program not to mention they most likely hitch these programs on legitimate programs that's downloaded illegally. Trojans work that way and they install themselves without you noticing them.

Hopefully OP reported this crime at the least to the cybercrime division of OP's country because hackers aren't scared because no one reports them even if it's left unchecked at the least they will have a record of this incident so when more people report similar situations, they can just act on it. I do download movies and animes in my phone so these scares me big time but this helped me remember to always double-check the address that I will transfer my funds.

[Ultegra134]

I'm going through a fresh Windows installation as we speak, even though my computer looks safe so far, as no antivirus can detect any kind of malware right now.

If you can, install Linux OS as well on your PC and use it only to install wallets, performing transactions and maybe trading.

There are fewer chances of picking up malware via Linux unless if one is way too careless. I have mine and I have never ever felt unsafe like I do when using Windows even though I have not many random apps installed in it.
Antivirus software programs are just bullshit and can give you a false sense of security.

I've only used Ubuntu once, quite a few years ago, and it's a completely different environment that I couldn't get used to. However, they're definitely safer and ideal for such applications, which makes me consider it, especially now that I've installed a second HDD, one of which could be Windows and the other Ubuntu. It'll only be isolated for the wallet, which would make it a lot safer than it being on a Windows environment that's been used at the same time.

awareness is the key when transacting, you have to not only double check but triple check on addresses, we never know if we have this, even if we have these popular antiviruses.

Antiviruses is easily bypassed if the scammer/hacker is good enough at creating a program not to mention they most likely hitch these programs on legitimate programs that's downloaded illegally. Trojans work that way and they install themselves without you noticing them.

Hopefully OP reported this crime at the least to the cybercrime division of OP's country because hackers aren't scared because no one reports them even if it's left unchecked at the least they will have a record of this incident so when more people report similar situations, they can just act on it. I do download movies and animes in my phone so these scares me big time but this helped me remember to always double-check the address that I will transfer my funds.

Antiviruses can be bypassed when it's a new type of malware or virus. After user reports, they update their software to include such malicious attempts. Back then, there wasn't a single mention similar to my case, so I guess I was probably one of their first victims. Reporting to the authorities wouldn't change a thing; I had no details other than a wallet's address, and while the amount I was scammed was petty for them to even bother, they'd laugh at me if I reported that my 25 XRP coins, then worth about $10, were stolen due to a fake extension.

[logfiles]

I've only used Ubuntu once, quite a few years ago, and it's a completely different environment that I couldn't get used to.

Trust me, with time, you eventually get used to It.
I will speak for myself, I am not a nerd and Linux gave me some hard time for the first few weeks, but I got used to it after a while. When I am into transactions and trading, I often use it as compared to my Windows 11. Everyone always starts from somewhere.

The only downside is that there are some platforms that just have Windows and macOS app support and no Linux, but this is minimal

[Agbamoni]

 must say you're quite lucky and very attentive to details. Imagine if you weren't observant; you could have lost even more money. To be honest, I don't think the extension was the sole reason for this issue. Most extensions usually require authorization before they can run in your browser, like Chrome or others. I'd like to know, did you ever give authorization to the Google Sheets extension? Or are you suggesting that it gained permission without your consent? If it's the latter, it's clear that any extension that doesn't ask for your permission should be avoided, as it seems to be a scam extension. This is a serious matter, as I also have several extensions on my device, some of which I downloaded from websites I don't fully trust. I think I'll go back and check those extensions to be on the safe side.