Malicious Chrome and Firefox extensions steal Axiom Trade and Padre crypto traders' session and wallet data
Researchers found four booby-trapped browser extensions (J7Tracker, VREO, Orbit Tracker) stealing login sessions and wallet data from Axiom Trade and Padre users. Chrome listings are gone; Orbit Tracker was live on Firefox. Remove them and log out of those sites.
Open your browser's extensions page and remove J7Tracker, VREO, Orbit Tracker, GhostApe and GhostApe Color if present. If you trade on Axiom Trade or Padre in the same browser profile, sign out everywhere, sign in again, and review wallet activity and connected sessions for anything you did not do.
- J7Trackerno fixed version yet
- VREOno fixed version yet
- VREOno fixed version yet
- Orbit Trackerno fixed version yet
What’s happening
Security firm Socket reported on 9 September 2026 that extensions named J7Tracker, VREO (Chrome and Firefox versions) and Orbit Tracker secretly collect data from people using the Axiom Trade and Padre crypto trading platforms. The data includes login details, access tokens and wallet-related keys held in the browser, which could let an attacker act on a victim's trading account. J7Tracker and VREO share the same collection code and send it to attacker-run web servers; Orbit Tracker uses different code and servers, and also sends the victim's email address to the operator through Telegram. Socket says Google removed the Chrome listings in July 2026, along with two related extensions, GhostApe and GhostApe Color, for policy violations. Orbit Tracker was still available on Mozilla's add-on store when Socket published, and Socket reported it to Mozilla; the sources do not say whether the Firefox VREO listing was removed, or whether Orbit Tracker has since been taken down. Neither source reports how many people installed the extensions or how much money was lost. Removal from a store does not remove an extension already installed.
- What
- Poisoned software
- Affects
- Browser extensions J7Tracker, VREO and Orbit Tracker (Chrome and Firefox) used with Axiom Trade and Padre
- Affected
- J7Tracker (Chrome, version 2.79.3 cited)
VREO (Chrome and Firefox, Firefox version 2.79.4 cited)
Orbit Tracker (Firefox, version 2.0 cited) - Fixed in
- No fix yet
- Since
- 9 Sept 2026
- Closed
- 14 Sept 2026
Timeline
- Update
Invaders published its own write-up confirming the same extensions and data. It said Orbit Tracker was live on Mozilla Add-ons as of 9 September and that no victim or loss figures had been published.
- Made publicPartly fixed
Socket publicly identified J7Tracker, VREO (Chrome and Firefox) and Orbit Tracker as malicious. They collect logged-in session and wallet-related data from users of the Axiom Trade and Padre trading platforms. Orbit Tracker was still live on Mozilla Add-ons and Socket reported it to Mozilla.
- Update
Socket reports that Google removed the Chrome listings in July 2026. J7Tracker and VREO were removed for malware; two related listings, GhostApe and GhostApe Color - Theme Customizer, were removed for policy violations.
Sources
- Malicious Chrome and Firefox Extensions Steal Crypto Traders' Session and Wallet DataSocket · 9 Sept 2026
- Malicious browser extensions target crypto tradersInvaders · 14 Sept 2026