A Wolf Installed Itself In The Browser And The Lambs Said "Five Stars, Very Helpful"

Oh good. Another Tuesday.

A fake Chrome extension, dressed up as a legitimate MEXC trading tool, has been quietly hoovering up API keys from anyone gullible enough to install it. The ticks embedded themselves right in the browser, waited for the Flock to log in and start trading, then shipped those credentials straight to the coyotes via Telegram. Telegram. The audacity.

Let me be clear about what happened here. A Lamb went looking for a trading tool, found something that looked official, clicked install, granted it every permission it asked for, and then went about their day completely unbothered. Meanwhile their API keys, withdrawal permissions included, were already sitting in some attacker's chat window with a little thumbs-up emoji next to them.

I need a coffee. I need six coffees.

The fake grain here is almost impressively lazy. This wasn't some sophisticated hole in the fence. This was a wolf wearing a fleece vest that said "OFFICIAL TRADING TOOL" in Comic Sans and the Lambs just... let it in. The extension could initiate withdrawals. Actual money. Gone. Because someone couldn't be bothered to check the developer name for more than half a second.

The Shepherds, naturally, will ask for a one-page summary and then schedule a meeting about the meeting.

What makes this particularly fun for me, a person who has not slept since what I believe was Thursday, is that browser extensions are basically the Sky Pasture of endpoint security. Totally unmonitored, wildly over-permissioned, and beloved by the Flock because they make things "convenient." Every extension your Lambs have installed is a potential tick waiting for the right moment. Congratulations on your fifteen coupon clippers and your "AI writing assistant."

MEXC has been notified. The extension has been pulled. The damage, for those already bitten, is done.

Remediation

Look, I'll keep this short because my eyes are doing that thing again.

Audit your browser extensions. All of them. Right now. If a Lamb in your Flock has anything crypto-related installed, verify it against the official vendor's website, not the Chrome store search bar.

Restrict API key permissions. If a key doesn't need withdrawal access, it should not have withdrawal access. Minimum privilege. Write it on a sticky note. Put it on the Shepherds' door.

Enable withdrawal whitelisting on any exchange that supports it. Make the coyotes work harder than this.

Treat the browser as hostile territory. Because it is. It always has been. You just forgot.

Staying awake so you don't have to, barely.

Original Report: https://thehackernews.com/2026/01/malicious-chrome-extension-steals-mexc.html