MEDIUMVulnerability
Global

Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses

·Source: The Hacker News

Updated:

Executive Summary

Cybersecurity researchers have flagged an active browser extension campaign that is designed to steal cryptocurrency by stealthily replacing wallet addresses when unsuspecting users initiate a transaction. The cryptocurrency clipper activity has been codenamed Silent Swap by McAfee Labs. "The campaign is delivered through unsigned installers – observed in both .NET and Golang variants – that

Analysis

Cybersecurity researchers have flagged an active browser extension campaign that is designed to steal cryptocurrency by stealthily replacing wallet addresses when unsuspecting users initiate a transaction. The cryptocurrency clipper activity has been codenamed Silent Swap by McAfee Labs. "The campaign is delivered through unsigned installers – observed in both .NET and Golang variants – that
Source Attribution

Originally published by The Hacker News on Jun 30, 2026.

Related Threats

MEDIUMVulnerabilityNEW

The Payments Association names Renuka Rawlins director of policy and government affairs

The Payments Association, a trade body for the payments sector, has appointed Renuka Rawlins as its new Director of Policy & Government Affairs.

Finextra
MEDIUMVulnerabilityNEW

Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts

Cybersecurity researchers have warned of a "massive, ongoing, automated password spray attack" aimed at Microsoft's Azure command-line interface (CLI), compromising dozens of accounts in the process. The activity, per Huntress, originates from an IPv6 address range (2a0a:d683::/32) controlled by internet infrastructure provider LSHIY LLC (AS32167). "Between June 12 and June 26, the threat

The Hacker News
CRITICALVulnerability

NVD CRITICAL: CVE-2026-6070 — The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated A...

The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is acce

CVE-2026-6070
NIST NVD