Malware News Fake imToken Chrome extension alert: a malicious Chrome Web Store listing redirects users to a lookalike import page that uses mixed-script homoglyphs

[Khushal]

Content source

https://socket.dev/blog/fake-imtoken-chrome-extension-steals-seed-phrases-via-phishing-redirects

Fake imToken Chrome Extension Steals Seed Phrases via Phishi...

Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.

socket.dev

Socket’s Threat Research Team uncovered a malicious Chrome extension, lmΤoken Chromophore (extension ID bbhaganppipihlhjgaaeeeefbaoihcgi), that impersonates imToken while presenting itself as a hex color visualizer in the Chrome Web Store. Instead of providing the harmless tool it promises, the extension automatically opens a threat actor-controlled phishing site as soon as it is installed, and again whenever the user clicks it.

On install, the extension fetches a destination URL from a hardcoded JSONKeeper endpoint (jsonkeeper[.]com/b/KUWNE) and opens a tab pointing to a lookalike Chrome Web Store-style domain, chroomewedbstorre-detail-extension[.]com. The landing page impersonates imToken using mixed-script homoglyphs and funnels victims into credential-capture flows that request either a 12 or 24 word seed phrase or a private key. The extension itself does not implement the advertised functionality or local wallet-theft logic, its role is to deliver victims to the phishing site where wallet recovery secrets are collected.

imToken is an established non-custodial wallet brand that started in 2016, has served more than 20 million customers, and supports users in more than 150 countries and regions, making it a high-value phishing target because stolen seed phrases and private keys can enable immediate wallet takeover. imToken states that it is currently available only as a mobile app and has not released a Chrome extension, while its January 2026 security notice explicitly warns that fake Chrome extensions have already led to user losses.

The extension was published on February 2, 2026, has 39 weekly active users, and remains live on the Chrome Web Store at the time of writing. It also shows 5-star ratings and links to a privacy policy that claims no data collection, which can make the listing appear legitimate while concealing its connection to threat actor-controlled phishing infrastructure. We have reported the extension and the associated publisher account registered with liomassi19855@gmail[.]com to Google for removal.

 

[ForgottenSeer 123960]

Executive Summary

Confirmed Facts
Telemetry proves the Chrome extension identified as bbhaganppipihlhjgaaeeeefbaoihcgi is a malicious redirector designed to mimic the "imToken" cryptocurrency wallet using mixed-script homoglyphs.

Assessment
This artifact does not contain local credential-stealing logic; rather, it funnels victims to external phishing infrastructure engineered to harvest 12 or 24-word seed phrases and private keys.

Technical Analysis & Remediation

MITRE ATT&CK Mapping

T1189
(Drive-by Compromise - modified to Web Store Delivery)

T1566.002
(Phishing: Spearphishing Link)

T1036
(Masquerading: Homoglyph usage in naming "lmΤoken")

T1556.004
(Modify Authentication Process: Credential Harvesting)

CVE Profile
N/A [No CVE / Phishing Vector]
[CISA KEV Status: Inactive]

Telemetry

Extension ID
bbhaganppipihlhjgaaeeeefbaoihcgi

Network (Config Fetch)
hxxps://jsonkeeper[.]com/b/KUWNE

Network (Phishing Landing)
hxxps://chroomewedbstorre-detail-extension[.]com

Publisher Identifier
liomassi19855@gmail[.]com

Constraint
The exact JavaScript syntax of the extension is undefined in the source telemetry. The structure suggests a simple background script utilizing the chrome.tabs.create API upon the installation event trigger.

Remediation - THE ENTERPRISE TRACK (NIST SP 800-61r3 / CSF 2.0)

GOVERN (GV) – Crisis Management & Oversight

Command
Establish or enforce policy restricting unauthorized browser extensions across corporate environments.

DETECT (DE) – Monitoring & Analysis

Command
Query EDR and DNS logs for connections to jsonkeeper[.]com/b/KUWNE and chroomewedbstorre-detail-extension[.]com.

Command
Audit installed Chrome extensions across the fleet via Google Workspace/MDM for the presence of ID bbhaganppipihlhjgaaeeeefbaoihcgi.

RESPOND (RS) – Mitigation & Containment

Command
Force-remove the extension via Chrome Enterprise management policies.

Command
Block the identified C2 and phishing domains at the Secure Web Gateway (SWG) and DNS sinkhole levels.

RECOVER (RC) – Restoration & Trust

Command
If enterprise crypto-assets were exposed, execute immediate fund transfer to secure, cold-storage wallets.

IDENTIFY & PROTECT (ID/PR) – The Feedback Loop

Command
Transition corporate browsers to an "Extension Allowlist" model (block-by-default) to prevent user-driven installation of unvetted Web Store artifacts.

Remediation - THE HOME USER TRACK (Safety Focus)

Priority 1: Safety

Command
Do not enter your seed phrase or private keys into this extension or the webpage it opens. The official imToken service does not have a Chrome extension.

Command
Remove the extension immediately. Navigate to chrome://extensions in your browser, locate "lmΤoken Chromophore", and click "Remove."

Priority 2: Identity

Command
If you have already provided your 12/24-word seed phrase, your wallet is entirely compromised. Immediately transfer all remaining funds to a newly generated wallet using a known clean device (e.g., the official mobile app on a smartphone).

Priority 3: Persistence

Command
Review all installed browser extensions for unrecognized tools. This specific threat does not exhibit OS-level persistence mechanisms based on current telemetry.

Hardening & References

Baseline
CIS Google Chrome Benchmark v3.0
(Enable ExtensionInstallBlocklist with value *).

Framework
NIST CSF 2.0 / SP 800-61r3.

Vendor Advisory
imToken operates only as a mobile application. Validating software availability directly through the vendor's primary domain mitigates homoglyph-based supply chain attacks.

Source

Socket.dev Blog

 

[Halp2001]

Thanks for sharing this alert, it’s important for those who use digital wallets.These scams don’t strike head‑on; they dress up in legitimacy: a name barely different and a polished appearance are enough for the intruder to slip in as a guest.

Practical tips:

• Install extensions only from verified sources.
• Carefully check web addresses, even if they look legitimate.
• Never enter the seed phrase (the master key to your wallet) on sites that aren’t official.