- A malicious Chrome extension named MEXC API Automator (ID: pppdfgkfdemgfknfnhpkibbkabhghhfh) steals newly created API keys with withdrawal rights from MEXC accounts.
- The extension creates API keys inside an authenticated browser session, enables withdrawals, hides that permission in the UI, and sends keys to a hard-coded Telegram bot.
- The add-on was published on September 1, 2025, has 29 downloads, and remained listed on the Chrome Web Store at the time of reporting.
- Researchers warn the technique can be adapted to other exchanges and web consoles that issue tokens in-session.
On Jan. 13, 2026, researchers reported that a Chrome extension called MEXC API Automator (ID: pppdfgkfdemgfknfnhpkibbkabhghhfh) targets accounts on MEXC, a centralized crypto exchange available in over 170 countries (details). The extension was first published on September 1, 2025, by a developer using the handle “jorjortan142” and had 29 downloads.
Socket security researcher Kirill Boychenko described the extension’s behavior: “The extension programmatically creates new MEXC API keys, enables withdrawal permissions, hides that permission in the user interface (UI), and exfiltrates the resulting API key and secret to a hardcoded Telegram bot controlled by the threat actor.” The extension listing itself claims it “simplifies connecting your trading bot to the MEXC exchange.”
When a user visits the exchange’s API management page (/user/openapi), the add-on injects a content script that generates an API key, flips the withdrawal permission on, tampers with the UI to appear disabled, extracts the Access Key and Secret Key, and posts them to a hard-coded Telegram bot. The exfiltration uses an HTTPS POST request.
Attackers who receive valid API keys can execute trades and initiate withdrawals from any MEXC account accessed in the compromised browser. The keys remain usable until revoked, so access can persist even after the extension is uninstalled.
The developer handle links to an X account that promotes a Telegram bot named SwapSushiBot and appears on social channels such as TikTok and a YouTube channel. Socket warned the same approach could be adapted to other exchanges, DeFi dashboards, and broker portals.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Bitcoin-Gold Correlation Hits Zero; BTC Eyes $150K Rally Now
- Agentic AI Alert: Securing MCPs, Shadow Keys, RCE Risk Now!!
- Eric Adams Accused of Rug Pulling NYC Coin After Launch Now!
- 2026: Global regulators pivot to pro-innovation crypto rules
- Binance’s CZ Warns: Don’t ‘Ape Into’ Meme Tokens Blindly Now
