Malicious Extension Has Been Live Since 2024 With Few Users

[mendez]

Despite being active since June 18, 2024, Crypto Copilot has only 15 users, according to the Chrome Store. Socket has filed a takedown request. The extension advertises itself as a convenience tool for trading Solana directly from X, but is designed to skim small amounts over many swaps.

[Nahid Hossen]

Even low-user extensions can pose huge risks if left undetected for long.