Fake imToken Chrome Extension Redirects Users to Wallet Phishing Pages
Summary
Socket researchers say a fake imToken Chrome extension redirects users to lookalike pages soliciting seed phrases or private keys. It fetches destinations from a hardcoded JSONKeeper endpoint and was reported live with 39 weekly users.
Key points
- Socket researchers identified the lmToken Chromophore extension (ID bbhaganppipihlhjgaaeeeefbaoihcgi), published February 2, 2026; the article reports it remained live with 39 weekly active users.
- The extension redirects users on installation and click, fetching a destination from a hardcoded JSONKeeper endpoint.
- A mixed-script imToken lookalike page at chroomewedbstorre-detail-extension[.]com requests a 12- or 24-word seed phrase or a plaintext private key.
- The phishing flow uses externally hosted scripts on compute-fonts-appconnect[.]pages[.]dev, then shows a fake setup sequence and opens token[.]im as a decoy.
- imToken says it has not released a Chrome extension and is available only as a mobile app; Socket says it reported the extension and publisher account to Google.
- The researchers recommend restricting extensions in sensitive browser profiles and rotating wallet keys immediately if recovery secrets were entered on a phishing page.
Article Details
- Attack Vectors
- A malicious Chrome extension impersonates imToken as a hex color visualizer and redirects users on installation and when clicked.
- The extension fetches a destination from a hardcoded JSONKeeper endpoint and opens a lookalike imToken page using mixed-script homoglyphs.
- The phishing pages request 12- or 24-word seed phrases or plaintext private keys. After submission, they present a fake password setup and status flow, then open the legitimate token.im site as a decoy.
- External JavaScript files hosted on compute-fonts-appconnect.pages[.]dev support the phishing pages’ mnemonic and form-processing flows.
- Defensive Notes
- Restrict extension installations in sensitive browser profiles and verify wallet software through official distribution channels.
- Inspect extensions that fetch remote configuration and open external destinations; hunt for homoglyph-based lookalike domains, remote-config endpoints, and external scripts tied to wallet-import flows.
- Treat any wallet whose seed phrase or private key was entered into the phishing flow as compromised and rotate to new keys immediately.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
liomassi19855@gmail[.]com | Publisher account email that the article identifies as associated with the malicious extension. | |
| URL | hxxps[:]//chroomewedbstorre-detail-extension[.]com/detail-bbhaganppipihlhjgaaeeeefbaoihcgi | Lookalike phishing page used as the extension’s primary redirect destination. |
| URL | hxxps[:]//chroomewedbstorre-detail-extension[.]com/detail-bbhaganppipihlhjgaaeeeefbaoihcgi/Private-Key/ | Phishing page identified as collecting plaintext wallet private keys. |
| URL | hxxps[:]//chroomewedbstorre-detail-extension[.]com/detail-bbhaganppipihlhjgaaeeeefbaoihcgi/S%D0%B5%D0%B5d-Phrase/ | Phishing page identified as collecting wallet seed phrases. |
| URL | hxxps[:]//compute-fonts-appconnect[.]pages[.]dev/formScript.js | Externally hosted form-processing script used by the phishing flow. |
| URL | hxxps[:]//compute-fonts-appconnect[.]pages[.]dev/jsbip39.js | Externally hosted BIP39 helper script used by the phishing page. |
| URL | hxxps[:]//compute-fonts-appconnect[.]pages[.]dev/sjcl-bip39.js | Externally hosted script identified as supporting mnemonic handling in the phishing flow. |
| URL | hxxps[:]//compute-fonts-appconnect[.]pages[.]dev/wordlist_english.js | Externally hosted wordlist script used by the phishing page’s mnemonic flow. |
| URL | hxxps[:]//www[.]jsonkeeper[.]com/b/KUWNE | Remote configuration endpoint used by the extension to retrieve its redirect destination. |
MITRE ATT&CK
T1036 · MasqueradingThe extension listing and phishing pages imitate imToken branding, and the phishing page uses mixed-script homoglyphs.T1056.003 · Web Portal CapturePhishing web forms capture wallet seed phrases and plaintext private keys.T1059.007 · JavaScriptThe extension’s background.js uses JavaScript to fetch remote configuration and open a browser tab to the returned destination.T1176.001 · Browser ExtensionsThe attack is delivered through a Chrome extension that redirects users to remote phishing pages.T1195.002 · Compromise Software Supply ChainThe malicious extension was published through the Chrome Web Store, which the article describes as a trusted distribution channel.T1204 · User ExecutionInstalling the extension triggers its redirect automatically; clicking the extension also triggers the redirect.T1566 · PhishingLookalike pages use wallet-import flows to solicit seed phrases or private keys.T1583.001 · DomainsThe article identifies a lookalike domain used to host the phishing pages.T1583.006 · Web ServicesThe extension uses a JSONKeeper endpoint for remote configuration, and the phishing flow uses externally hosted scripts.T1656 · ImpersonationThe phishing pages impersonate imToken to make the wallet-import flow appear legitimate.
Vendors
GoogleWe have reported the extension and the associated publisher account registered with liomassi19855@gmail[.]com to Google for removal.imTokenChrome extension, lmToken Chromophore (extension ID bbhaganppipihlhjgaaeeeefbaoihcgi), that impersonates imToken while posing as a hex color visualizer and immediately redirects users to threat actor-controlled
Products
Chrome Web Store[T1195.002 ] Supply Chain Compromise – The extension was published in the Chrome Web Store to deliver malicious behavior via a trusted distribution channel.Google ChromeSocket’s Threat Research Team discovered a malicious Chrome extension, lmToken Chromophore (extension ID bbhaganppipihlhjgaaeeeefbaoihcgi), that impersonates imToken while posing as a hex color visualizer andimTokenChrome extension, lmToken Chromophore (extension ID bbhaganppipihlhjgaaeeeefbaoihcgi), that impersonates imToken while posing as a hex color visualizer and immediately redirects users to threat actor-controlledlmToken ChromophoreSocket’s Threat Research Team discovered a malicious Chrome extension, lmToken Chromophore (extension ID bbhaganppipihlhjgaaeeeefbaoihcgi), that impersonates imToken while posing as a hex color visualizer and