Malicious Google Notes Extension Swaps Crypto Wallet Addresses During Transactions

Gbhackers •Mayura Kathir • July 1, 2026

Technically sophisticated campaign delivering a malicious Chromium extension that silently swaps cryptocurrency wallet addresses during transactions. Delivered via unsigned installers observed in both .NET and Golang variants access, the payload masquerades as a minimalist “Google Notes” browser extension. Once deployed, the extension acts as a clipboard-aware crypto clipper: it monitors copy-and-paste activity, recognizes wallet addresses […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious Google Notes Extension Swaps Crypto Wallet Addresses A malicious browser extension named 'Google Notes' targets cryptocurrency users by swapping wallet addresses during transactions. This clipper malware is delivered through unsigned installers on Chromium-based browsers, making detection difficult. The extension masquerades as a note-taking tool while monitoring and altering copied wallet addresses. It operates by requesting extensive permissions, including access to all websites and the clipboard, which are atypical for such applications. McAfee researchers identified the extension, which has a global impact, particularly in India, where a higher concentration of affected users has been noted. The malware retrieves command server domains from public blockchain smart contracts, complicating detection efforts. Users are advised to verify wallet addresses, install extensions only from official sources, and maintain device protection. 2 sources 68

Extracted Entities

Malicious Google Notes Extension Swaps Crypto Wallet Addresses During Transactions

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (1)