Urgent: Malicious Extension Targeting Reddit Users

Hey everyone, Meow from Jupiter here.

Wanted to bring to everyone’s urgent attention a chrome extension that has appears to be targeting Reddit users called “Bull Checker“. If you have this installed, please uninstall this right away.

https://preview.redd.it/zmpp7gg1kojd1.png?width=792&format=png&auto=webp&s=6891dfdd0e7c72a498f7ee570c0bd13ffb05a88a

Over the past few days, we have been working extremely hard to track down a malicious software that has drained a few Solana DeFi users already, and we have triangulated on this extension as the main problem.

https://x.com/JupiterExchange/status/1825600323320434830

Users with this extension would interact with the dApps as per normal, have the simulation show up as normal, but have the possibility of their tokens being maliciously transferred to another wallet upon transaction completion.

For full technical details, refer to my post here:

https://www.jupresear.ch/t/identification-of-malicious-extension/21584

We believe that many reddit users might have gotten exposure to this extension because of a few postings by u/solana_og got a ton of visibility (tho he appears to have edited away mention of this extension)

https://x.com/SlorgoftheSlugs/status/1825617566489817182

The same user has been promoting Bull Checker many many times on reddit over past 2 weeks, so we fear that many users would have seen it by now.

Extensions are especially tricky because they have access to read/write data across anything you visit, so please do not install anything you don’t 100% trust.

Besides this, I am very sure that there are other extensions out there, it is just that this one is probably the most prominent now till to the effective marketing.

It breaks our hearts to have some users have a large amount of their hard earned savings from years of hard degening get drained, so please please please stay safe!