Solana users targeted by ‘Bull Checker’ Chrome extension scam

A brand new malicious browser extension referred to as “Bull Checker” is reportedly concentrating on Solana customers on Reddit disguised as a meme coin tracker.

The extension evaded detection programs and drained Solana customers’ wallets.

Solana goal customers

Previously week, Jupiter’s pseudonymous founder Meow Meow, report Some Solana DeFi customers skilled unauthorized token drains. By way of an intensive investigation with companions, they traced the problem to Bull Checker, which had been concentrating on customers on numerous Solana-related Reddit subreddits.

The extension permits customers to work together with decentralized functions (dApps) usually, however it secretly transfers tokens to unauthorized wallets after a transaction is accomplished. Jupiter’s founder emphasised that no vulnerabilities had been found within the dApp or the pockets itself.

They urge customers to take away the “Bull Checker” extension or any comparable extension that has broad permissions however can’t be instantly trusted.

Bull Checker is designed as a read-only extension designed to show meme coin holders. Ideally, such an extension shouldn’t require permissions to learn or write information on all websites, which ought to trigger concern for customers. Regardless of this, some customers proceed to put in and use it.

As soon as put in, Bull Checker waits for customers to work together with commonplace dApps on its official area after which adjustments transactions earlier than the pockets indicators them. The modified transaction nonetheless seems “regular” within the simulation, hiding its true intention as a shopper.

Whereas researching the Chrome extension, Jupiter’s founders additionally found that it was promoted by the nameless Reddit account “Solana_OG.” This individual seems to be concentrating on customers seeking to commerce meme cash and engaging them to obtain the extension.

Pay shut consideration to hazard indicators

Meow issued a robust warning to customers, stressing the significance of remaining skeptical when encountering suggestions on Reddit or different media platforms, regardless of what number of likes or constructive feedback they obtain.

The founder highlighted the hazards of “astroturfing and social engineering,” the place unhealthy actors can manipulate public notion to unfold dangerous instruments just like the “Bull Checker” extension. They additional added that extensions that require broad permissions, resembling the flexibility to learn and modify all web site materials, must be handled with excessive warning.

“Whereas we have now recognized one malicious extension, there should be others. There have been reviews of different drains, however we had been unable to search out them. In case you suspect that an extension comprises malware, particularly if additionally they have “Learn ” and “Change” permissions, please uninstall it instantly.