Characterizing Cryptocurrency-Themed Malicious Browser Extensions

The popularity of cryptocurrencies has led to the growth of browser extensions, including malicious ones that cause financial losses and evade vetting processes. We conduct a systematic study to identify and characterize cryptocurrency-themed malicious extensions. By monitoring seven extension distribution venues for 18 months (December 2020 to June 2022) and collecting around 3,600 unique extensions, we identify 186 malicious extensions in five categories. We analyze their distribution channels, life cycles, developers, behaviors, and illegal gains, revealing their status quo , disguises, and programmatic features. Our work unveils the status quo of the cryptocurrency-themed malicious extensions and reveals the disguises and programmatic features on which detection techniques can be based. Our work serves as a warning to extension users, and as an appeal to extension store operators to enact dedicated countermeasures. To facilitate future research in this area, we release our dataset of the identified malicious extensions and open source our analyzer.