SlowMist Reports Advanced TRON Wallet Phishing Attack With Chrome Extension Impersonation And Remote Iframe Loading

by
Alisa Davidson

Printed: Could 11, 2026 at 8:21 am Up to date: Could 11, 2026 at 8:23 am

by Anastasiia O

Edited and fact-checked:
Could 11, 2026 at 8:21 am

To enhance your local-language expertise, typically we make use of an auto-translation plugin. Please be aware auto-translation might not be correct, so learn authentic article for exact info.

Menace intelligence agency SlowMist reported that it has recognized a high-risk phishing marketing campaign geared toward TRON pockets customers, involving a malicious Chrome MV3 extension designed to impersonate the Menace intelligence agency SlowMist reported that it has recognized a high-risk phishing marketing campaign geared toward TRON pockets customers, involving a malicious Chrome MV3 extension designed to impersonate the TronLink Pockets model. 

In line with the evaluation, the assault combines misleading branding, remotely loaded person interfaces, and data-exfiltration mechanisms in a layered construction supposed to seize pockets credentials whereas decreasing the chance of detection throughout overview.

The primary stage of the marketing campaign facilities on a fraudulent browser extension that mimics a official TRON-related device. SlowMist stated the extension depends on Unicode bidirectional management characters and Cyrillic homoglyphs to make its identify seem much like the official TronLink label. Though the bundle itself presents as a low-permission extension, its conduct modifications after set up. When the person opens the popup, the extension checks a distant endpoint and, if out there, hundreds a full interface from an exterior iframe reasonably than counting on a static native web page.

That distant part varieties the second stage of the operation. The phishing website intently imitates the look and performance of the TronLink net pockets, together with the pages used to import mnemonic phrases, non-public keys, and keystore recordsdata. SlowMist stated the interface collects delicate info equivalent to restoration phrases, non-public keys, keystore knowledge, and passwords, then forwards it by server-side APIs to attacker-controlled infrastructure. The report indicated that the information is relayed in actual time by the Telegram Bot API.

The extension additionally shops a number of native markers, together with details about whether or not the distant service is reachable, the URL used for the iframe, and up to date search information. SlowMist famous that these things can stay in native storage till the extension is eliminated. As a result of the seen popup content material is pulled from a distant supply, the malicious conduct could be modified with out modifying the extension bundle itself, complicating static evaluation and traditional retailer overview procedures.

Inside TRON Phishing Marketing campaign: Anti-Evaluation Methods, Geo-Focusing on, And Multi-Layer Assault Structure

In line with the report, the phishing web page consists of extra safeguards meant to hinder investigation. These measures embrace blocking right-click actions, disabling textual content choice, intercepting developer instruments shortcuts, suppressing console output, stopping dragging, and blocking print instructions. The web page additionally tracks customer conduct and checks whether or not a session must be blocked, redirecting suspicious visitors to a clean web page. SlowMist stated these controls are supposed to frustrate sandbox testing and automatic inspection.

The evaluation additional described geographic filtering logic, with customers detected from Russian-language settings or Russian time zones being redirected to a separate area. SlowMist interpreted this conduct as both region-specific phishing dealing with or an try and keep away from consideration from native investigators. The principle infrastructure was recognized as a distant area hosted on Vercel, whereas different official TRON ecosystem companies embedded within the code have been described as a part of fallback or question performance reasonably than malicious exercise.

SlowMist characterised the operation as a two-layer assault mannequin by which a misleading browser extension acts because the preliminary contact level whereas a remotely managed net web page carries out the precise credential theft. The corporate stated this design illustrates how malicious actors can separate seen shell parts from hidden backend conduct, making the marketing campaign tougher to establish by routine static checks alone. 

The warning was issued as a reminder for customers and safety groups to deal with unauthorized extensions with warning, overview put in browser add-ons, and monitor for uncommon visitors tied to wallet-import workflows and associated phishing infrastructure.

Alisa, a devoted journalist on the MPost, focuses on crypto, AI, investments, and the expansive realm of Web3. With a eager eye for rising traits and applied sciences, she delivers complete protection to tell and interact readers within the ever-evolving panorama of digital finance.

Extra articles