Recently, the SlowMist MistEye security monitoring system captured a high-risk phishing sample targeting TRON wallet users. The sample disguises itself as a Chrome MV3 (Manifest V3) extension related to the TRON wallet ecosystem, constructing a complete wallet credential theft chain through a combination of brand impersonation and remotely variable UI loading.
The attack technique is divided into two layers: the first layer is a fake TronLink Chrome extension that uses Unicode bidirectional control characters and Cyrillic homoglyphs to spoof the brand name. After installation, it prioritizes loading a remote iframe as the popup interface; the second layer is a remote phishing page that fully imitates the UI and functionality of the TronLink Wallet web wallet, collecting mnemonic phrases, private keys, keystore files, and passwords without the user’s awareness, and exfiltrating them through same-origin APIs and a Telegram Bot. Static extension package reviews are unable to fully cover the subsequent behaviors of remote iframe-loaded interfaces, therefore this analysis report is published for community defense and self-inspection purposes.
MistEye is a Web3 threat intelligence and dynamic security monitoring system independently developed by SlowMist. It integrates security monitoring and threat intelligence aggregation capabilities to provide users with real-time risk alerts and asset protection.
After capturing this fake TronLink Chrome extension and its associated remote phishing page, the MistEye system triggered a high-risk alert and pushed notifications to clients.
This sample is a Chrome MV3 extension whose package structure disguises itself as a legitimate blockchain explorer tool.
The extension’s manifest.json uses Chrome internationalization mechanisms to point the extension name and title to locale message files. Inside _locales/en/messages.json, the attacker used Unicode bidirectional control characters and Cyrillic homoglyphs to construct the string T\u202Enor\u202CL\u0456\u202Ekn, making the browser display layer appear highly similar to the official TronLink brand. This constitutes deceptive distribution behavior targeting wallet users.
This malicious extension displays data such as “1,000,000+ users” and “4.5 stars (353 reviews)” on the Chrome Web Store page. However, these values are not forged by the extension code itself — Chrome Web Store user counts, ratings, and reviews are all tied to the extension’s item ID and inherited with the same store listing. The attacker most likely first gained control over a legitimate extension listing with a large installation base or high ratings, then uploaded a new version replacing the name, icon, and description, thereby presenting a “millions of users, high rating” trustworthy appearance on the store page and significantly reducing victim suspicion.
The extension only requests the storage permission, while simultaneously declaring access to and in host_permissions. The former is the remote popup loading endpoint, while the latter is used for fallback local query logic. The permission declaration is intentionally kept minimalistic to evade review.
After the user installs the extension, clicking the extension icon to open the popup triggers the following attack chain:
The key loading logic is as follows:
This pattern allows attackers to replace the popup-displayed remote page content at any time without updating the extension package itself. Static extension package reviews cannot cover the subsequent behavior of the remote iframe.
The extension stores three categories of local markers in localStorage:
These data remain stored until the extension is manually removed.
After downloading and analyzing the primary site hosted at tronfind-api.tronfindexplorer.com, it was confirmed to be a fully functional fake TronLink Wallet web wallet with comprehensive credential theft capabilities.
The site is a single-page application built with .js. Its page title, UI text, and layout all impersonate TronLink Wallet, with an appearance highly similar to the official TronLink web wallet, making it difficult for ordinary users to visually distinguish authenticity.
The site embeds multiple layers of sensitive information collection logic into the wallet import workflow:
3. When generating a new wallet, the code records generated mnemonic phrases through trackEvent(“Generated mnemonic: …”).
4. Keystore passwords and import passwords within the import process are also logged through the trackEvent(…) function.
5. Multi-signature wallet verification popups request users to input the mnemonic phrase or private key corresponding to the “authority address,” which is likewise reported through sendWords(…).
The site implements a comprehensive visitor identification and anti-analysis mechanism:
The page contains multiple anti-analysis mechanisms:
These measures increase the difficulty of security analysis and forensic investigation.
The code contains geographic detection logic: when Russian browser languages or Russian-related time zones are detected, the page automatically redirects users to trx-scan-explorer.org, indicating that the attackers may adopt different phishing strategies for specific regions or attempt to avoid local law enforcement attention.
The core infrastructure of this attack is tronfind-api.tronfindexplorer.com, which simultaneously serves as both the remote UI loading endpoint and the backend for credential theft. The associated domain trx-scan-explorer.org, used as a diversion target for Russian-region users, should likewise be considered part of the malicious infrastructure.
The remote phishing page is hosted on the Vercel platform (detected through the x-vercel-id response header). The attackers leverage Vercel’s edge network to achieve improved availability and concealment.
It should be noted that api.trongrid.io and tronscan.org, hardcoded within the extension code, are legitimate TRON ecosystem services used only for local fallback query and redirect logic, and are not considered malicious IOCs.
This attack is a dual-layer phishing attack chain:
The attackers’ use of anti-analysis mechanisms, visitor blocking logic, and geo-targeted traffic diversion demonstrates mature phishing attack engineering capabilities.
This “local extension shell + remotely variable phishing content” attack model poses challenges to traditional static extension review processes. The extension package itself may contain no directly malicious code, while the popup can be fully replaced through remote iframes, and the phishing page content can change dynamically at any time.
The review-evasion design of this attack chain deserves particular attention:The local CRX extension merely appears to be a low-permission TRON query tool and remote iframe loader, while the actual wallet phishing and credential theft logic is hosted in a remote .js page. The remote endpoint further employs multiple mechanisms including 404/301 traffic diversion, visitor blocking, Russian-language/Russian-timezone redirection, and anti-analysis logic, making it difficult for automated review systems or manual investigators to consistently observe the real phishing interface.Combined with frontend multi-dimensional anti-crawling and environment detection techniques (such as sandbox blocking and geo-targeted diversion for Russian regions), this “shell-core separation + dynamic environment confrontation” architecture significantly reduces the probability of the malicious payload being detected by security platforms.
The following information is provided only for user self-verification and authenticity comparison and should not be treated as malicious IOC data:
Users may distinguish authenticity by comparing extension IDs.
tronfind-api[.]tronfindexplorer[.]com
trx-scan-explorer[.]org
https[:]//tronfind-api[.]tronfindexplorer[.]com/
https[:]//tronfind-api[.]tronfindexplorer[.]com/api/data/words
https[:]//tronfind-api[.]tronfindexplorer[.]com/api/visitor/track
https[:]//tronfind-api[.]tronfindexplorer[.]com/api/visitor/create
https[:]//tronfind-api[.]tronfindexplorer[.]com/api/visitor/enrich
https[:]//tronfind-api[.]tronfindexplorer[.]com/api/visitor/sync
MD5: ce612d027e631d6633582227eb29002f
SHA1: 94d651b42355f2b0765a7435e5a5927623807225
SHA256: 6b4a4b64e6f969017cb3a9a71dd3038ddf32b989e5342dbbe36650d5802f2ee4
SHA256: b84b89f0a1b7f00431274ac676104acaaa73d440e5731161d1077e733014cc29
filename: 27-a530a8c5aa9059e0.js
SHA256: 0cbf4f21cf157227d2c3fba80b64e1f4c3f9d2cc0bf926e024252c35e93edd5a
SlowMist is a threat intelligence firm focused on blockchain security, established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.
SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.
By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
