TLDR
Victim installs malicious Chrome extension ('Binance Wallet Helper', 'Binance Trade Bot') that injects overlay over real binance.com. Captures credentials + 2FA on login. Indicators: (1) publisher not 'Binance Holdings Ltd'; (2) installed...
How it works
Victim installs malicious Chrome extension ('Binance Wallet Helper', 'Binance Trade Bot') that injects overlay over real binance.com. Captures credentials + 2FA on login. Indicators: (1) publisher not 'Binance Holdings Ltd'; (2) installed...
Red flags
- Urgent pressure to click, pay, or share codes immediately.
- A link or sender that does not match the official organization.
- Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What to do
- 1Indicators: (1) publisher not 'Binance Holdings Ltd'; (2) installed via direct link not Web Store search; (3) requests 'read and change data on all websites'; (4) login page shows new 'security verification' field; (5) ratings <50 with generic 5 stars.
Source
Binance-Security
Source reviewed by Mythos Forensic Team
https://www.binance.com/en/support/announcement/FAQ
Is Fake Binance phishing — malicious Chrome extension overlay a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What should I do first?
Indicators: (1) publisher not 'Binance Holdings Ltd'; (2) installed via direct link not Web Store search; (3) requests 'read and change data on all websites'; (4) login page shows new 'security verification' field; (5) ratings <50 with generic 5 stars.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.