Jupiter, a Solana-based DEX aggregator, has recently detected a malicious extension on Chrome browser. As per Jupiter, the respective Chrome extension reportedly permits the malicious transaction of tokens to other wallets after a transfer’s completion. The platform provided the details about this in its exclusive social media post.

Jupiter Discloses Malicious Chrome Extension Executing Unauthorized Transfers for Solana Users

Jupiter noted that it received some reports about the funds’ drainage from some of the consumers of Solana DeFi. The extension targets memecoin traders mostly. On this, the platform conducted a comprehensive investigation and detected a malicious browser extension for Chrome. The extension named “Bull Checker” reportedly had focused on the consumers on many Solana-related subreddits. Clients using the respective extension would reportedly communicate with the decentralized applications just as usual.

However, users just see a simulation that makes it appear normal. Contrarily, their assets may maliciously go to some other wallet on the completion of a transfer. Jupiter has advised about utilizing the respective extension or the others like it with enhanced permissions they don’t trust. It cautioned them to quit using such extensions immediately as this may result in extensive losses.

Trending Now: Digital Asset Inflows Shrink to $30M, $SOL Faces Record Outflows

In addition to this, the platform added that it found no vulnerability in the wallets or the decentralized applications. In its report, Jupiter provided a couple of instances of transfers that have reportedly interacted with some malicious program. According to it, both cases witnessed the addition of malicious instructions to normal Raydium and Jupiter instructions. Following that the user normally authorizes the transactions.

The ‘Bull Checker’ Has the Permission to Read as Well as Change Site Data, Leading to Funds Drainage

Nevertheless, the user’s authority and tokens moved to some malicious address. On this, it conducted an additional investigation of many impacted consumers.  They reportedly saw fund drainage by the respective extension. Based on its investigation, Jupiter labelled “Bull Checker” as a malicious extension. It reportedly has the permissions concerning the reading as well as changing the data present on a website.

Jupiter pointed toward these permissions as a potential cause for the funds’ drainage. In addition to this, it also revealed that Raydium has validated the use of the extension by its impacted consumers. Jupiter asserted that although this raises significant concerns, many users keep on installing and utilizing the extension.