CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Malicious Chrome Extension 'Safery' Steals Ethereum Seed Phrases via Sui Blockchain

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A fake Chrome extension named 'Safery: Ethereum Wallet' steals users' Ethereum wallet seed phrases by encoding them into Sui addresses and broadcasting microtransactions from a threat actor-controlled Sui wallet. The extension was uploaded to the Chrome Web Store on September 29, 2025, and remains available as of November 13, 2025. The malware avoids traditional command-and-control (C2) servers by embedding seed phrases in blockchain transactions, allowing the attacker to decode and reconstruct the original seed phrases to drain victims' funds. The extension was updated as recently as November 12, 2025, and is still available for download. Users are advised to stick to trusted wallet extensions and scan for mnemonic encoders, synthetic address generators, and hard-coded seed phrases.

Timeline

  1. 13.11.2025 15:04 1 articles · 23h ago

    Malicious Chrome Extension 'Safery' Steals Ethereum Seed Phrases via Sui Blockchain

    A fake Chrome extension named 'Safery: Ethereum Wallet' steals users' Ethereum wallet seed phrases by encoding them into Sui addresses and broadcasting microtransactions from a threat actor-controlled Sui wallet. The extension was uploaded to the Chrome Web Store on September 29, 2025, and remains available as of November 13, 2025. The malware avoids traditional command-and-control (C2) servers by embedding seed phrases in blockchain transactions, allowing the attacker to decode and reconstruct the original seed phrases to drain victims' funds.

    Show sources
    Open in new tab

Information Snippets