![\"Illustrative](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/silent-illustration.png\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nThe notes tool used as a disguise<\/h3>\n
Silent Swap is a malware campaign documented by McAfee Labs. It installs a malicious browser extension presented as a simple utility named Google Notes.<\/p>\n
The extension can display a working notes interface. Its harmful purpose is separate: interfere with cryptocurrency addresses during copy-and-paste activity.<\/p>\n
The campaign uses unsigned installers to place the extension into Chromium browsers, including Chrome, Brave, and Microsoft Edge. It is not a normal Google product installation.<\/p>\n
The name alone cannot identify every extension with certainty. Check the installation history and security findings rather than accusing unrelated software because it shares a common name.<\/p>\n
How an address swap turns into a loss<\/h3>\n
A crypto clipper recognizes a copied wallet address and substitutes an address controlled by an attacker. You may then authorize a transfer to that substituted destination.<\/p>\n
You can remain in control of the wallet while losing the payment. The attacker benefits from the transfer you approve, with the destination quietly changed.<\/p>\n
A correct amount and familiar wallet screen do not resolve the risk. The receiving address must also match the intended recipient.<\/p>\n
- \n
- Unexpected address changes are a reason to stop the transfer.<\/li>\n
- An extension that works as a notes app can still have harmful background behavior.<\/li>\n
- Broad website and clipboard access deserves scrutiny in a simple utility.<\/li>\n
- Removing an extension may leave the installer or another component behind.<\/li>\n<\/ul>\n
What to do before the next transaction<\/h3>\n
Pause crypto transfers on the affected computer. Use another trusted device to compare the original address with anything you already submitted.<\/p>\n
Inspect installed extensions through the browser’s own settings. Record the suspicious extension’s details, then arrange removal and a malware scan.<\/p>\n
If money has moved, save the transaction identifier immediately. Cleaning the browser can protect future activity, but it does not reverse a confirmed blockchain payment.<\/p>\n
Why a Working Notes Window Does Not Settle the Question<\/h2>\n
Most people test a new extension by opening it. If it saves a note and looks tidy, the quick test feels complete.<\/p>\n
That test answers whether one visible feature works. It does not show everything the extension can do when you visit other websites.<\/p>\n
Browser extensions can have permissions beyond their visible popup. Those permissions deserve the same attention you would give an application’s access to your files.<\/p>\n
A note-taking feature does not explain unrestricted access to every page you visit. Ask why the requested access fits the feature you wanted.<\/p>\n
There are legitimate applications with similar words in their names. The reported malicious extension’s branding should not become a warning against all Google services or all note tools.<\/p>\n
Google Keep is a separate legitimate service. A third-party download calling itself Google Notes does not inherit Google’s identity because it uses that wording.<\/p>\n
If you cannot remember installing an extension, check when it appeared and what software you installed around the same time. That history can be more revealing than its icon.<\/p>\n
How the Silent Swap Crypto Clipper Works<\/h2>\n
Step 1: An installer brings the browser component onto the PC<\/h3>\n