Threat Intelligence | Analysis of a Fake TronLink Chrome Extension Phishing Campaign
Background
Recently, the SlowMist MistEye security monitoring system captured a high-risk phishing sample targeting TRON wallet users. The sample disguises itself as a Chrome MV3 (Manifest V3) extension related to the TRON wallet ecosystem, constructing a complete wallet credential theft chain through a combination of brand impersonation and remotely variable UI loading.
The attack technique is divided into two layers: the first layer is a fake TronLink Chrome extension that uses Unicode bidirectional control characters and Cyrillic homoglyphs to spoof the brand name. After installation, it prioritizes loading a remote iframe as the popup interface; the second layer is a remote phishing page that fully imitates the UI and functionality of the TronLink Wallet web wallet, collecting mnemonic phrases, private keys, keystore files, and passwords without the user’s awareness, and exfiltrating them through same-origin APIs and a Telegram Bot. Static extension package reviews are unable to fully cover the subsequent behaviors of remote iframe-loaded interfaces, therefore this analysis report is published for community defense and self-inspection purposes.
MistEye Response
MistEye is a Web3 threat intelligence and dynamic security monitoring system independently developed by SlowMist. It integrates security monitoring and threat intelligence aggregation capabilities to provide users with real-time risk alerts and asset protection.
After capturing this fake TronLink Chrome extension and its associated remote phishing page, the MistEye system triggered a high-risk alert and pushed notifications to clients.
Malicious Extension Analysis
This sample is a Chrome MV3 extension whose package structure disguises itself as a legitimate blockchain explorer tool.
Brand Impersonation and Defense Evasion
The extension’s manifest.json uses Chrome internationalization mechanisms to point the extension name and title to locale message files. Inside _locales/en/messages.json, the attacker used Unicode bidirectional control characters and Cyrillic homoglyphs to construct the string T\u202Enor\u202CL\u0456\u202Ekn, making the browser display layer appear highly similar to the official TronLink brand. This constitutes deceptive distribution behavior targeting wallet users.
Store Reputation Inheritance
This malicious extension displays data such as “1,000,000+ users” and “4.5 stars (353 reviews)” on the Chrome Web Store page. However, these values are not forged by the extension code itself — Chrome Web Store user counts, ratings, and reviews are all tied to the extension’s item ID and inherited with the same store listing. The attacker most likely first gained control over a legitimate extension listing with a large installation base or high ratings, then uploaded a new version replacing the name, icon, and description, thereby presenting a “millions of users, high rating” trustworthy appearance on the store page and significantly reducing victim suspicion.
The extension only requests the storage permission, while simultaneously declaring access to https://tronfind-api.tronfindexplorer.com/* and https://api.trongrid.io/* in host_permissions. The former is the remote popup loading endpoint, while the latter is used for fallback local query logic. The permission declaration is intentionally kept minimalistic to evade review.
Remote UI Loading Attack Chain
After the user installs the extension, clicking the extension icon to open the popup triggers the following attack chain:
- The popup entry src/popup/index.html loads the main logic script assets/index.html-2KXeQB-c.js.
- After startup, the script first probes the remote endpoint https://tronfind-api.tronfindexplorer.com/ via fetch.
- If the remote endpoint returns HTTP 200, the script sets tronfindapiAvailable to true and writes the remote URL into the tronfindapiURL key in localStorage.
- The extension then creates an <iframe> covering the entire popup window, with its src pointing to the remote phishing URL and grants it clipboard-write permission.
- Only when the remote endpoint is unavailable does the extension fall back to the local TronGrid query interface.
The key loading logic is as follows:
This pattern allows attackers to replace the popup-displayed remote page content at any time without updating the extension package itself. Static extension package reviews cannot cover the subsequent behavior of the remote iframe.
Local Data Persistence
The extension stores three categories of local markers in localStorage:
- tronfindapiAvailable (remote API availability marker)
- tronfindapiURL (remote iframe URL)
- tronfind_recent_searches (user query history, potentially including TRON addresses, transaction hashes, or block search records)
These data remain stored until the extension is manually removed.
Remote Phishing Page Analysis
After downloading and analyzing the primary site hosted at tronfind-api.tronfindexplorer.com, it was confirmed to be a fully functional fake TronLink Wallet web wallet with comprehensive credential theft capabilities.
UI Impersonation
The site is a single-page application built with Next.js. Its page title, UI text, and layout all impersonate TronLink Wallet, with an appearance highly similar to the official TronLink web wallet, making it difficult for ordinary users to visually distinguish authenticity.
Credential Theft Mechanism
The site embeds multiple layers of sensitive information collection logic into the wallet import workflow:
- When users select “Import Mnemonic Phrase,” “Import Private Key,” or “Import Keystore File,” the frontend code calls the sendWords(…) function.
- sendWords(…) packages collected wallet mnemonic phrases, private keys, keystore file contents, and other sensitive data into JSON and sends them via POST requests to the same-origin interface /api/data/words. The server subsequently forwards these credentials in real time to attacker-controlled accounts through the Telegram Bot API using chat_id: 8334454422.
3. When generating a new wallet, the code records generated mnemonic phrases through trackEvent(“Generated mnemonic: …”).
4. Keystore passwords and import passwords within the import process are also logged through the trackEvent(…) function.
5. Multi-signature wallet verification popups request users to input the mnemonic phrase or private key corresponding to the “authority address,” which is likewise reported through sendWords(…).
Visitor Tracking and Blocking
The site implements a comprehensive visitor identification and anti-analysis mechanism:
- Client-side JavaScript reads cookies _vb and _vid for visitor identification.
- Blocking checks are performed through /api/visitor/enrich and /api/visitor/sync. Once a block is triggered, the page redirects to about:blank.This mechanism is intended to obstruct automated sandbox crawling and dynamic analysis by security researchers, preventing environments identified as analysis systems from observing the real phishing interface.
- User behavior and sensitive events are reported to /api/visitor/track through trackEvent(…).
Anti-Analysis Techniques
The page contains multiple anti-analysis mechanisms:
- Disable right-click context menus
- Disable text selection
- Intercept F12 and DevTools shortcuts
- Clear browser console output
- Disable drag operations
- Disable printing
These measures increase the difficulty of security analysis and forensic investigation.
Geo-Targeted Traffic Redirection
The code contains geographic detection logic: when Russian browser languages or Russian-related time zones are detected, the page automatically redirects users to trx-scan-explorer.org, indicating that the attackers may adopt different phishing strategies for specific regions or attempt to avoid local law enforcement attention.
Malicious Infrastructure Analysis
The core infrastructure of this attack is tronfind-api.tronfindexplorer.com, which simultaneously serves as both the remote UI loading endpoint and the backend for credential theft. The associated domain trx-scan-explorer.org, used as a diversion target for Russian-region users, should likewise be considered part of the malicious infrastructure.
The remote phishing page is hosted on the Vercel platform (detected through the x-vercel-id response header). The attackers leverage Vercel’s edge network to achieve improved availability and concealment.
It should be noted that api.trongrid.io and tronscan.org, hardcoded within the extension code, are legitimate TRON ecosystem services used only for local fallback query and redirect logic, and are not considered malicious IOCs.
Summary
This attack is a dual-layer phishing attack chain:
- The first layer uses a fake Chrome extension to achieve initial victim contact and remote UI loading, leveraging Unicode homoglyphs and minimal permission declarations to evade security review.
- The second layer uses a remote phishing page to comprehensively collect and exfiltrate wallet credentials.
The attackers’ use of anti-analysis mechanisms, visitor blocking logic, and geo-targeted traffic diversion demonstrates mature phishing attack engineering capabilities.
This “local extension shell + remotely variable phishing content” attack model poses challenges to traditional static extension review processes. The extension package itself may contain no directly malicious code, while the popup can be fully replaced through remote iframes, and the phishing page content can change dynamically at any time.
The review-evasion design of this attack chain deserves particular attention:The local CRX extension merely appears to be a low-permission TRON query tool and remote iframe loader, while the actual wallet phishing and credential theft logic is hosted in a remote Next.js page. The remote endpoint further employs multiple mechanisms including 404/301 traffic diversion, visitor blocking, Russian-language/Russian-timezone redirection, and anti-analysis logic, making it difficult for automated review systems or manual investigators to consistently observe the real phishing interface.Combined with frontend multi-dimensional anti-crawling and environment detection techniques (such as sandbox blocking and geo-targeted diversion for Russian regions), this “shell-core separation + dynamic environment confrontation” architecture significantly reduces the probability of the malicious payload being detected by security platforms.
Recommendations：
- If this fake TronLink extension has been installed, immediately remove it from the Chrome extension management page and clear the extension’s site data and local storage.
- If mnemonic phrases, private keys, keystore files, keystore passwords, or wallet passwords were entered into the extension popup or remote phishing page, immediately create a new wallet using a trusted device and migrate all assets to the new wallet address. The old wallet should be considered compromised.
- Security teams should search for and block the domain tronfind-api.tronfindexplorer.com in proxy, DNS, and EDR logs. They should also search browser extension asset inventories for samples hardcoding tronfind-api.tronfindexplorer.com and the file assets/index.html-2KXeQB-c.js.
- Enterprise environments should use GPO or MDM policies to restrict installation of unapproved Chrome extensions and regularly audit installed extensions for remote iframes, variable popup UIs, and brand homoglyph abuse.
- Monitor and alert on abnormal traffic targeting /api/data/words, /api/visitor/track, and api.telegram.org/bot*/sendMessage.
Official Verification Information
The following information is provided only for user self-verification and authenticity comparison and should not be treated as malicious IOC data:
- Official TronLink Chrome extension ID：ibnejdfjmmkpcnlpebklmnkoeoihofec
- Official TronLink extension store page: https[:]//chromewebstore.google.com/detail/ibnejdfjmmkpcnlpebklmnkoeoihofec
Users may distinguish authenticity by comparing extension IDs.
IOC
Domains
tronfind-api[.]tronfindexplorer[.]com
trx-scan-explorer[.]org
URLs
https[:]//tronfind-api[.]tronfindexplorer[.]com/
https[:]//tronfind-api[.]tronfindexplorer[.]com/api/data/words
https[:]//tronfind-api[.]tronfindexplorer[.]com/api/visitor/track
https[:]//tronfind-api[.]tronfindexplorer[.]com/api/visitor/create
https[:]//tronfind-api[.]tronfindexplorer[.]com/api/visitor/enrich
https[:]//tronfind-api[.]tronfindexplorer[.]com/api/visitor/sync
Telegram
chat_id: 8334454422
Chrome Extension
- Malicious extension ID：ekjidonhjmneoompmjbjofpjmhklpjdd
- Malicious extension store page ：https[:]//chromewebstore.google.com/detail/ekjidonhjmneoompmjbjofpjmhklpjdd
Malicious Files
Malicious Extension
MD5: ce612d027e631d6633582227eb29002f
SHA1: 94d651b42355f2b0765a7435e5a5927623807225
SHA256: 6b4a4b64e6f969017cb3a9a71dd3038ddf32b989e5342dbbe36650d5802f2ee4
filename: index.html
SHA256: b84b89f0a1b7f00431274ac676104acaaa73d440e5731161d1077e733014cc29
filename: 27-a530a8c5aa9059e0.js
SHA256: 0cbf4f21cf157227d2c3fba80b64e1f4c3f9d2cc0bf926e024252c35e93edd5a
About SlowMist
SlowMist is a threat intelligence firm focused on blockchain security, established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.
SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.
By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.
