[WARNING][SECURITY] Dangerous Browser Extensions Drain CPU & Risk Crypto Wallets

[StrangeRider]

TL;DR:
A popular crypto extension (Backpack) secretly hijacked my laptop’s resources for months. Their "airdrop rewards" likely came from stolen CPU power. Full investigation + proof on my socials.  

---  

My Story (Short Version):
1️⃣ The Problem:  
- Laptop crashed every 10-15 mins  
- CPU usage spiked to 90%+ (see screenshot)  
- Overheating damaged hardware (repairs)  

2️⃣ The Discovery:
- Traced crashes to Backpack extension  
- Found hidden processes mining crypto (logs attached)  
- Instant fix: Uninstalled it → CPU normalized  

3️⃣ The Risk:
- Your wallet keys could be exposed via background scripts  
- "Free airdrops" = scam to farm your resources  

---  

Full Analysis Here:  
→ X.com Thread: Telegram Guide:[/b] [url=http://delete

---  

Why This Matters:
- 100+ users already reported similar issues
- Extensions like this erode trust in crypto tools  
- Protect your hardware and assets!  

Tags: [SECURITY][WARNING][ANN]  

[Cricktor]

Why did it take you months to do something and clean the shit from your laptop? I would advise to wipe storage on that laptop and re-install clean. Consider to change any password of every service you used on that laptop while you had the malware on it.

Why did you install some dubious browser extension on a device where you do your crypto wallet stuff on? I would minimise any potential risk on a device for crypto coin stuff. You don't need browser extensions, except maybe for Metamask if you need that. Any browser extension needs to be reputable and trustworthy on such devices for crypto.

What makes you sure that your device is clean, when you enabled such a kind of malware on it and as it seems you just disabled and maybe deleted the offending browser extension only?

Why further details only on your (a)socials?

[Findingnemo]

Why did it take you months to do something and clean the shit from your laptop?

Just lazy, I am talking about me.

I once infected my device with such extension hijacker which is not stealing anything as OP said but it's started hijacking my homepage and search results, whenever I search something it lands an yahoo search result and to be honest I didn't know the exact reason why this happens for few months until someone suggested me to try malwarebytes which found the culprit and managed to wipe my system out.

Even when we download the extensions from the official source, the malware are bundled with it.

[btcltcdigger]

Well, as soon as your computer is "idling" with CPU over 50%, that's a red flag. You obviously don't take care of your computer if you missed that one.
As for extensions, just disable any while you're not using them. Even the legit ones can be misused by a "angry employee".

[logfiles]

1. Where are the screenshots?
2. Where are the logs?

Is this the extension (https://chromewebstore.google.com/detail/backpack/aflkmfhebedbjioipglgcbcmnbpgliof) you are talking about? It has 800,000 users. I looked through the reviews, but I am not seeing any complaints regarding the CPU draining, including yours.
Should we really take you serious?

[BitMaxz]

It seems a CryptoTab happened to my son's laptop. He said that his laptop suddenly slowed after installing a script or something on his laptop. It looks like the script stuff with malware cryptotab and steals the CPU power.
The laptop is very hot when I check it until I find the culprit that looks like a miner on the browser that keeps hijacking the CPU. I'm glad it didn't end up the same as yours. If ever it happens, I can repair it myself.
My son's laptop is infected with almost all viruses and malware because the majority of the scripts he uses contain malware. Usually he plays Roblox with no cryptocurrency or money involved, so I just clean it with Malwarebytes and Kaspersky.

Hackers are constantly developing new ways to exploit and victimize innocent people, so be extremely cautious about any files you download and use on your PC/laptop.

[NotATether]

You cannot "drain" a CPU. You can drain a battery from excessive CPU usage though.

This looks like a cryptominer. How come your antivirus didn't catch it?

[knowngunman]

Why further details only on your (a)socials?

I expected to see some graphics attached to his posts on his socials and assumed he did refer us to his socials probably because he can't post images here due to his rank. I checked the post but found no images attached. Moreover, the post looks more like an advert for Solana and phantom wallet. I don't know whether it was a deliberate attempt but in whatever case, never chase airdrops with your main wallet. If possible, have a separate device for your main wallet and another device for other stuffs.

[ABCbits]

I find message on the telegram is weird. He know how to reinstall OS and replace hardware, but never thought to use Task Manager which would point that browser use all CPU resource.

You cannot "drain" a CPU. You can drain a battery from excessive CPU usage though.

This looks like a cryptominer. How come your antivirus didn't catch it?

And since it's packaged as browser extension, all modern browse should automatically prevent it from being installed or at least warn the extension use too much CPU resource. I'm sure firefox block cryptomining by default these days.

[Zwei]

TL;DR:
A popular crypto extension (Backpack) secretly hijacked my laptop’s resources for months. Their "airdrop rewards" likely came from stolen CPU power. Full investigation + proof on my socials. 

i'm sorry but your "Full investigation" + "proof" which you didn't provide btw (screenshot and logs) is laughable.
unless you are going to dive into the code and show us solid evidence of what you claim, you are just talking about things you don't understand.

you didn't link to the supposed extension, so we can't verify what you are talking about or if you even had the official extension installed to begin with.
the abnormal CPU spikes you had could be caused by anything really.
one positive hit from totascan can't be called proof of anything.

[Lucius]

~snip~
Should we really take you serious?

Maybe the OP just wanted to promote his social networks with a good story? It is usually done in these ways, and if you are not looking for concrete evidence, then the story may seem convincing.

~snip~
This looks like a cryptominer. How come your antivirus didn't catch it?

The OP probably doesn't even have it, or it's so bad that it failed to block such a basic threat. Having a problem like that for a few months and only then realizing where the problem is doesn't sound very convincing.

[logfiles]

Maybe the OP just wanted to promote his social networks with a good story? It is usually done in these ways, and if you are not looking for concrete evidence, then the story may seem convincing.

You are probably right. The fact that he is trying to make us visit his social media links for "full analysis" says it all. Any other serious person would have shared all the details in the very first post to prove the there's something wrong with the extension

I am sure it would have been flagged by chrome after a few reports

[StrangeRider]

Wow, I didn’t even think anyone would see or respond to my findings regarding the virus. It doesn’t matter to me whether anyone visits my social media profiles or not; I just wanted to issue a warning. Honestly, I never used that wallet again, and my laptop started running better. But it’s still quite popular. To be fair, I don’t really remember the details from a year and a half ago. Just check your browser extensions—that’s where I found the virus, if I recall correctly. As for my social media, it’s of no consequence to me; there’s nothing there now, so no need to follow. If I had known that someone would actually care about my investigation, I certainly would have done more, but now—a year and a half later—it doesn’t really matter anymore.