As reported by The Hacker News, McAfee Labs has identified an active cryptocurrency clipper campaign dubbed Silent Swap — a technically crafty operation that weaponizes a fake browser extension to intercept and manipulate wallet addresses at the exact moment a user initiates a transaction. This is a threat that demands immediate attention from anyone transacting in digital assets.
Why This Campaign Is More Dangerous Than It Looks
Crypto clipper malware is not new, but Silent Swap represents a meaningful evolution in delivery sophistication. By masquerading as a Google Notes extension — a brand with inherent user trust — attackers dramatically reduce suspicion at the installation stage. Most users granting browser extension permissions do so casually, rarely auditing what clipboard or DOM-access permissions they're accepting. This campaign exploits exactly that behavioral blind spot.
What makes this particularly insidious is the timing of the swap. The malicious substitution of wallet addresses doesn't happen at rest — it happens mid-transaction, in the fleeting window between when a user copies a destination address and when they paste it into a transfer field. Human confirmation bias does the rest: users rarely re-verify the full wallet string character-by-character before hitting send. Funds lost this way are, by design, unrecoverable.
The use of both .NET and Golang installer variants signals a deliberate effort to maximize platform reach and evade signature-based detection. Golang-compiled binaries in particular are known for producing large, statically-linked executables that many AV engines historically underperform against. This dual-language approach suggests a threat actor with operational maturity, not a script-kiddie campaign.
Who Is Most at Risk
The Broader Extension Ecosystem Problem
This campaign is a timely reminder that browser extension security remains one of the most underpoliced attack surfaces in enterprise environments. Extensions operate with broad privileges — clipboard access, DOM manipulation, network interception — that would trigger alarms if requested by any other software category. Yet most organizations have no inventory of what extensions exist across their fleet, let alone enforcement policies governing what's permitted.
The browser extension model was not designed with adversarial abuse at scale in mind. Silent Swap is one of dozens of malicious extensions active at any given time — the visible tip of a largely invisible attack surface.
The use of unsigned installers is also a significant indicator that defenders can act on. Unsigned executables dropped outside of standard software distribution channels should be treated as high-confidence threat signals, particularly in environments where application whitelisting or software restriction policies are in place.
Shield53 Recommendations
Immediate Actions for Individuals
- Audit browser extensions now. Remove any extension you didn't intentionally install from an official, verified source. Google Notes does not have an official standalone Chrome extension — any extension claiming to be one is fraudulent.
- Verify wallet addresses character-by-character after pasting — particularly the first 6 and last 6 characters, which attackers typically keep identical to avoid detection at a glance.
- Use hardware wallets with on-device address confirmation where possible. Physical confirmation on a hardware wallet display breaks the clipboard attack chain entirely.
- Enable clipboard monitoring alerts through endpoint security tools that flag unexpected clipboard reads by browser processes.
For Security Teams and CISOs
- Implement browser extension whitelisting via Chrome Enterprise, Intune, or equivalent MDM policy. Allow-list only verified, business-necessary extensions.
- Block unsigned executable installation via AppLocker, WDAC, or GPO-enforced software restriction policies.
- Add detections for clipboard-accessing browser extension processes in your EDR platform, particularly those reading clipboard data outside of user-initiated actions.
- Threat hunt for .NET and Golang unsigned dropper activity — look for newly created browser extension directories alongside unsigned installer artifacts in user-writable paths.
- Educate finance and treasury teams who handle crypto transactions about this specific attack pattern and mandate dual-confirmation workflows for any crypto disbursement.
Silent Swap is unlikely to be the last campaign of its kind. As crypto adoption expands into mainstream enterprise finance and retail use, clipper malware will evolve in lockstep. Organizations that treat the browser as a managed, policy-controlled endpoint — rather than an open application — will be meaningfully more resilient against this entire class of attack.
