{"id":"axiom-padre-malicious-extensions-sep-2026","category":"supply-chain","status":"closed","title":"Malicious Chrome and Firefox extensions steal Axiom Trade and Padre crypto traders' session and wallet data","tldr":"Researchers found four booby-trapped browser extensions (J7Tracker, VREO, Orbit Tracker) stealing login sessions and wallet data from Axiom Trade and Padre users. Chrome listings are gone; Orbit Tracker was live on Firefox. Remove them and log out of those sites.","summary":"Security firm Socket reported on 9 September 2026 that extensions named J7Tracker, VREO (Chrome and Firefox versions) and Orbit Tracker secretly collect data from people using the Axiom Trade and Padre crypto trading platforms. The data includes login details, access tokens and wallet-related keys held in the browser, which could let an attacker act on a victim's trading account. J7Tracker and VREO share the same collection code and send it to attacker-run web servers; Orbit Tracker uses different code and servers, and also sends the victim's email address to the operator through Telegram. Socket says Google removed the Chrome listings in July 2026, along with two related extensions, GhostApe and GhostApe Color, for policy violations. Orbit Tracker was still available on Mozilla's add-on store when Socket published, and Socket reported it to Mozilla; the sources do not say whether the Firefox VREO listing was removed, or whether Orbit Tracker has since been taken down. Neither source reports how many people installed the extensions or how much money was lost. Removal from a store does not remove an extension already installed.","action":"Open your browser's extensions page and remove J7Tracker, VREO, Orbit Tracker, GhostApe and GhostApe Color if present. If you trade on Axiom Trade or Padre in the same browser profile, sign out everywhere, sign in again, and review wallet activity and connected sessions for anything you did not do.","product":"Browser extensions J7Tracker, VREO and Orbit Tracker (Chrome and Firefox) used with Axiom Trade and Padre","audience":"home","severity":"high","patch":"partial","exploited":true,"cves":[],"tags":["supply-chain","browser-extension","chrome","firefox","crypto","axiom-trade","padre","session-theft"],"affected":["J7Tracker (Chrome, version 2.79.3 cited)","VREO (Chrome and Firefox, Firefox version 2.79.4 cited)","Orbit Tracker (Firefox, version 2.0 cited)"],"fixed":[],"matches":[{"platform":"chrome","app":"J7Tracker","bundle":"ingjjklimdeocggninaaapofondbeopd","fixed":""},{"platform":"chrome","app":"VREO","bundle":"nngccnjcllkehfiaidagbffjgbikcoij","fixed":""},{"platform":"firefox","app":"VREO","bundle":"vreo@j7tracker.io","fixed":""},{"platform":"firefox","app":"Orbit Tracker","bundle":"orbittracker@snapshot.xyz","fixed":""}],"sources":[{"kind":"research","title":"Malicious Chrome and Firefox Extensions Steal Crypto Traders' Session and Wallet Data","url":"https://socket.dev/blog/chrome-firefox-crypto-data-theft","by":"Socket","date":"2026-09-09"},{"kind":"research","title":"Malicious browser extensions target crypto traders","url":"https://invaders.ie/resources/blog/threat-hunting-and-intel/malicious-browser-extensions-target-crypto-traders","by":"Invaders","date":"2026-09-14"}],"started":"2026-09-09","closed":"2026-09-14","created":"2026-11-03T21:35:01.496Z","updated":"2026-11-03T21:35:01.496Z","cve_notes":[],"timeline":[{"at":"2026-09-14","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"Invaders published its own write-up confirming the same extensions and data. It said Orbit Tracker was live on Mozilla Add-ons as of 9 September and that no victim or loss figures had been published.","url":"https://invaders.ie/resources/blog/threat-hunting-and-intel/malicious-browser-extensions-target-crypto-traders","by":"Invaders","patch":null},{"at":"2026-09-09","added":"2026-11-03T21:32:34.430Z","kind":"disclosed","text":"Socket publicly identified J7Tracker, VREO (Chrome and Firefox) and Orbit Tracker as malicious. They collect logged-in session and wallet-related data from users of the Axiom Trade and Padre trading platforms. Orbit Tracker was still live on Mozilla Add-ons and Socket reported it to Mozilla.","url":"https://socket.dev/blog/chrome-firefox-crypto-data-theft","by":"Socket","patch":"partial"},{"at":"2026-07-01","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"Socket reports that Google removed the Chrome listings in July 2026. J7Tracker and VREO were removed for malware; two related listings, GhostApe and GhostApe Color - Theme Customizer, were removed for policy violations.","url":"https://socket.dev/blog/chrome-firefox-crypto-data-theft","by":"Socket","patch":null}],"url":"https://hard.fyi/live/axiom-padre-malicious-extensions-sep-2026/","json":"https://hard.fyi/api/live?id=axiom-padre-malicious-extensions-sep-2026"}