Key takeaways

LayerX security researchers (now part of Akamai) uncovered a campaign of nearly 30 malicious browser extensions designed to scam cryptocurrency investors by masquerading as legitimate, high-profile financial and/or cryptocurrency investors such as Warren Buffett, Andy Kreiger, Thomas Bulkowski, and others.

While the extensions all claim to be distinct, with different names, domains, and developers, they often share the same underlying infrastructure — and, in some cases, they even look identical.

Technical investigation reveals that each extension contains separate flows within it: one designed for casual users and reviewers, which appears completely benign, and one for targeted users, which leads them to external redirects and phishing pages intended to steal financial information.

Although the campaign currently has only a few hundred installs across approximately 30 extensions, the sheer number of parallel extensions and the complexity of the technical infrastructure behind it are…