Researchers found a harmful Chrome extension called Crypto Copilot that secretly siphons Solana from users during transactions. It injects hidden fees into swaps on the Raydium exchange, transferring funds to an attacker's wallet without user knowledge. The extension remains available for download, despite its malicious behavior.

A new variant of the ClickFix attack uses a malicious Chrome extension that pretends to be an ad blocker. It tricks users into executing harmful commands that install the ModeloRAT malware, primarily targeting corporate environments.