#ParsedReport #CompletenessMedium
09-09-2026

Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data

https://socket.dev/blog/chrome-firefox-crypto-data-theft

Report completeness: Medium

Threats:
J7tracker_stealer
Orbit
Ghostape_stealer
Vamp

Victims:
Axiom trade users, Padre users

TTPs:
Tactics: 3
Technics: 9

IOCs:
File: 4
Url: 3
Domain: 4
BrowserExtension: 4
Email: 3
Hash: 1

Soft:
Chrome, Firefox, Axiom, Vercel, IndexedDB, Telegram, Outlook

Crypto:
solana

Algorithms:
base64, sha256

Languages:
javascript