Partnered With:

The Google browser extension Shitcoin Wallet was found to contain malicious code that could steal users' private key information

Read this article in 4 Minutes

The malicious code can also obtain the user's login password on some encrypted trading platforms

Shitcoin Wallet, an extension based on the Google browser, was caught stealing passwords and private keys of users' cryptocurrency wallets.

An extension to the Google browser has been found to inject JavaScript code into web pages that can steal passwords and private keys from cryptocurrency wallets and portals, zdnet reports. This extension program called Shitcoin Wallet (Chrome extension ID: ckkgmccefffnbbalkmbbgebbojjogffn), last month launched on December 9.

It is understood that Shitcoin wallet allows users to manage ETH as well as Ethereum erc20-based generation. However, the wallet app is not as secure as Shitcoin's wallet promises. Yesterday, Harry Denley, director of security for MyCrypto, discovered that the extension contained malicious code.

Denley says the extension poses two dangers to users. First, managing money (ethereum or erc20-based tokens) inside the extension is risky. Denley said the extension sends the private keys of all wallets created or managed through their interfaces to third-party websites located at erc20wallet[.]tk. Second, the extension actively injects malicious JavaScript code as the user navigates to five of the better known cryptocurrency management platforms. This code is also used to steal login credentials (passwords) and private keys, which are also sent to the same & NBSP; Erc20wallet [.] tk Go to a third-party website.

As of the evening of January 1, 2020, Shitcoin Wallet is still available for download through the official Google Chrome web store, which shows 625 installation records.