Fake Google Notes Extension Steals Crypto by Swapping Wallet Addresses

McAfee Labs uncovered a campaign called Silent Swap that uses fake Google Notes browser extensions to replace cryptocurrency wallet addresses during transactions. The malware, delivered via unsigned .NET and Golang installers, intercepts clipboard data to redirect funds to attacker-controlled wallets. Users are advised to verify addresses manually and avoid untrusted extensions.