On 9 September 2026 Socket published research on six browser extensions that target traders on the Axiom and Padre platforms. Socket says the code runs inside the victim's authenticated session, reads application state, and sends it to attacker controlled hosts. This post separates what Socket observed from what it could not establish.
What happened
Socket (Kirill Boychenko) names these extensions: J7Tracker, VREO (Chrome and Firefox), Orbit Tracker, and GhostApe and GhostApe Color. Four listings are described as stealing data. The GhostApe pair is linked to the same publisher portfolio, and GhostApe appears to be a repackaged derivative of a legitimate extension called MockApe.
Socket reports that one shared module is byte identical across three extensions. On Padre it looks for a Firebase access token in localStorage and, as a fallback, in IndexedDB. On Axiom it queries user and wallet APIs. The data is Base64 encoded and sent through browser navigation to attacker controlled Vercel domains. Socket notes that this avoids cross origin requests and avoids needing host permissions in the manifest. Orbit Tracker uses different code and a separate server, and sends a Telegram notification to the operator.
Socket's context figures, which it attributes to the platforms: Axiom had over 47,000 daily active on chain traders in early August 2026, and Padre held about 4 to 5 percent of the Solana trading bot market.
Confirmed, reported and unknown
Reported by Socket from its analysis: the technique, the shared module, the stolen data types (Firebase tokens, user information, wallet related keys, cookies) and the store status below.
Store status: J7Tracker and VREO on Chrome were removed in July 2026 for malware, GhostApe and GhostApe Color were removed in July for policy violations, and Orbit Tracker was still live at publication and had been reported to Mozilla.
Unknown: install counts, any confirmed account takeover or theft, who is behind it (the link is by shared code and infrastructure, and weaker for Orbit Tracker), and how the Firefox VREO listing stands.
What to do now
- If you or your team trade on these platforms, list installed extensions in every browser profile and remove any of the six names.
- Sign out of Axiom and Padre everywhere, which invalidates session tokens, and review connected wallets.
- Move funds you cannot afford to lose to a wallet that was never used in the same browser profile.
- Use a separate browser profile with no extensions for anything that holds trading sessions.
How this could have been avoided
- Run trading and financial sessions in a dedicated profile with no third party extensions. The attack works because the extension shares a page with the authenticated app.
- Prefer extensions whose publisher you can verify, and treat a tool that repackages another extension as a red flag.
- In managed browsers, use an allowlist so extension installs require approval.
- Do not keep long lived tokens in localStorage of your own web app if you build such a platform. Short lifetimes and binding a session to a device narrow what a stolen token can do.
Quick check
Why does sending data by navigation matter to defenders?
It avoids cross origin requests and manifest host permissions, so permission review alone would not show it.
