cybersecurity company Socket discovered a malicious Chrome extension called "Crypto Copilot" secretly stealing funds from users' Solana transactions. This extension allows users to conduct Solana transactions directly from the X social media platform but injects additional instructions in each transaction, extracting at least 0.0013 SOL or 0.05% of the transaction amount.

Unlike typical wallet-draining malware, Crypto Copilot uses the Raydium decentralized exchange to execute transactions while adding a second instruction to transfer SOL to the attacker’s wallet, with the user interface only displaying the transaction summary and hiding the separate operation instructions.