On May 11, SlowMist disclosed that its security monitoring system, MistEye, identified a fake Chrome MV3 extension that launched a dual-layer phishing attack against TRON wallet users. The extension disguises itself as an official plugin through Unicode obfuscation and brand imitation. Once installed, it prioritizes loading a remote iframe pop-up page, enticing users to input their mnemonic phrases, private keys, keystore files, and passwords, which are then transmitted via a same-origin interface to a Telegram Bot. The malicious infrastructure involved includes tronfind-api[.]tronfindexplorer[.]com and trx-scan-explorer[.]org, with the malicious extension ID being ekjidonhjmneoompmjbjofpjmhklpjdd. SlowMist advises users to immediately uninstall this extension and, if sensitive information has been submitted, to promptly migrate their assets and discontinue use of the original wallet.