Socket: Malicious Extensions Drain Axiom Trade and Padre Crypto Sessions

What it is

Six malicious browser extensions targeting Axiom Trade and Padre (now Terminal) crypto traders. The summary covers the campaign shape; what follows is the material a defender needs to hunt and block, which the summary refers to but does not reproduce.

How it works

Two collector variants. The J7Tracker/VREO variant (vamp/axiom-fetch-intercept.js, byte-identical across three extensions) reads Padre localStorage keys padreV2-session, padreV2-stamper, padre-v2-bundles-store-v2, and recovers the Firebase access token — falling back to Firebase Auth's IndexedDB (firebaseLocalStorageDb, stsTokenManager.accessToken) if not in localStorage. On Axiom it collects user, bundle.bundleKey, sBundles, eBundles. Payload is Base64-encoded and exfiltrated via window.open/redirect (not fetch/XHR), so CSP connect-src and manifest host permissions don't reveal the destination. A source comment reads TON BOOKMARKLET AXIOM (INTACT), suggesting bookmarklet-drainer origin. Orbit Tracker uses a separate collector, different C2, and a Telegram bot that reports whether wallet data was found plus the victim's email; it opens axiom.trade on install/update.

Preconditions / Affected

Victim must have one of the extensions installed and be logged into Axiom Trade or Padre — collection is automatic once the session state exists; no manual export needed. Chrome listings (J7Tracker, VREO, GhostApe, GhostApe Color) were removed July 2026. Orbit Tracker remains live on Firefox as of publication.

What to do

Block these extension IDs across managed Chrome/Firefox and search historical inventories:

• J7Tracker Chrome ingjjklimdeocggninaaapofondbeopd
• VREO Chrome nngccnjcllkehfiaidagbffjgbikcoij; Firefox vreo@j7tracker.io
• Orbit Tracker Firefox orbittracker@snapshot.xyz
• GhostApe Chrome bnolicehjnimmdfkihmojhonickmhegp; GhostApe Color kkkoejaiilcofkhggclkbogjpinhjppm

Module SHA-256: 5b4fbe0658ff76f042c3cc2dfe3d1a3eda963e435a24dfc868cb583bde8c7b91

Hunt DNS/proxy/browser/EDR for these C2s and paths (preserve full URLs — data is encoded in the request):

• dcfdc-eight.vercel.app — /api/collect?d=
• snipex-iota.vercel.app — /api/code/
• susi.bonto.run — /collect?d=
• cloudflare.bonto.run

Other IOCs: VREO dev email z1417699@gmail.com; hardcoded Telegram ID 7680513699; Orbit Telegram bot 8375941889, recipient 6431519296.

Revoke/rotate affected Axiom and Padre sessions and tokens; review wallet activity for unauthorized transactions. Restrict extensions to an allowlist in profiles used for crypto/financial accounts, and isolate those sessions.

Caveats

Socket notes takedowns won't stop the activity — expect republishing under new IDs/publisher accounts with rotated C2. The durable detection is behavioral: extensions reading authenticated trading-session state and transmitting it externally, not the specific IOCs above.