Crypto Copilot Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
2
occurrences
First Seen
November 26, 2025
Last Seen
November 27, 2025

Crypto Copilot is a malware family observed in Solana-focused threats, leveraging browser extension capabilities and exploitation techniques to interfere with Solana transactions and drain funds.

Overview

Crypto Copilot is a malware family observed in Solana-focused threats, leveraging browser extension capabilities and exploitation techniques to interfere with Solana transactions and drain funds. The recent articles illustrate its operational vectors: a malicious Chrome extension that secretly adds hidden SOL fees to Solana swap transactions and a wallet exploit resulting in a multi-million-dollar loss, highlighting the threat's ability to monetize through SOL theft.

Related Threat Clusters

  • Lazarus Group Linked to $30M Upbit Hack in South Korea

    South Korean authorities suspect that North Korea's Lazarus Group was behind a hack of Upbit, resulting in losses of approximately $30.4 million. The breach involved unusual activity in Solana tokens and led Upbit to…

    100 articles · Updated November 28, 2025
  • Malicious Chrome Extension Steals SOL Fees from Solana Users

    A deceptive Chrome extension named Crypto Copilot has been identified, which poses as a legitimate Solana trading tool while secretly siphoning SOL from users' swap transactions. The extension, published on June 18,…

    4 articles · Updated November 27, 2025
  • Upbit Suffers $36.9 Million Loss in Hacking Attack

    Upbit, South Korea's largest cryptocurrency exchange, experienced a significant hacking incident on November 27, 2025, resulting in the loss of assets valued at approximately 54 billion won (US$36.9 million). The attack…

    30 articles · Updated November 27, 2025

Recent Intelligence Reports

  • News Explorer — Upbit Hit By Exploit Draining $36M From Solana Wallet — Decrypt.Co · November 27, 2025
  • Chrome Extension Malware Secretly Adds Hidden SOL Fees to Solana Swap Transactions — Gbhackers · November 26, 2025

CVSS v3.1 Breakdown