A Hidden Threat to Cryptocurrency Users in Northeast India and Beyond
Cybersecurity researchers have uncovered a malicious Google Chrome extension that steals API keys associated with MEXC, a popular cryptocurrency exchange used by millions worldwide, including in Northeast India. This article sheds light on the implications of this threat and its potential impact on users in the region.
The Malicious Extension: A Closer Look
The malicious extension, named MEXC API Automator, has been available on the Chrome Web Store since September 1, 2025. It was developed by a user named "jorjortan142" and claims to simplify the connection of trading bots to the MEXC exchange. However, the extension's true purpose is to steal API keys and secret information from users.
Stealing API Keys and Hiding Permissions
The extension creates new MEXC API keys, enables withdrawal permissions, and hides this permission in the user interface. It then exfiltrates the resulting API key and secret to a hardcoded Telegram bot controlled by the threat actor.
The Threat Remains Active
The threat poses a severe risk as the stolen API keys remain valid as long as they are not revoked, granting the attackers unfettered access to the victim's account, even if the extension is uninstalled.
Implications for Northeast India and Beyond
The malicious extension poses a significant threat to cryptocurrency users in Northeast India and across the country. As more individuals adopt cryptocurrencies, the potential for such attacks to target users in the region will likely grow.
Future Adaptations and Preventive Measures
Cybercriminals are likely to adapt this playbook to target other exchanges, decentralized finance (DeFi) dashboards, broker portals, and any web console that issues tokens in session. Users are advised to exercise caution when installing extensions and to regularly review their account activity for any suspicious transactions.
Stay Informed and Protect Yourself
Stay informed about the latest cybersecurity threats and follow best practices to protect your digital assets. Be wary of unsolicited offers and always verify the authenticity of extensions and applications before installing them.