Characterizing Cryptocurrency-themed Malicious Browser Extensions

Due to the surging popularity of various cryptocurrencies in recent years, a large number browser extensions have been developed as portals access relevant services, such cryptocurrency exchanges and wallets. This has stimulated wild growth themed malicious that cause heavy financial losses users legitimate service providers. They shown their capability evading stringent vetting processes extension stores, highlighting lack understanding this emerging type malware our community. In work, we conduct first systematic study identify characterize cryptocurrency-themed extensions. We monitor seven official third-party distribution venues for 18 months (December 2020 June 2022) collected around 3600 unique Leveraging hybrid analysis, identified 186 belong five categories. then those from perspectives including channels, life cycles, developers, illicit behaviors, illegal gains. Our work unveils status quo reveals disguises programmatic features on which detection techniques can be based. serves warning users, an appeal store operators enact dedicated countermeasures. To facilitate future research area, release dataset open-source analyzer.