Fake Notion Web Clipper extension stole $230K in ETH from two Macs
A counterfeit Chrome extension named "Notion Web Clipper" with just 12 installs planted a backdoor and spyware on two MacBooks, an M1 Pro and an M5 Pro. Chrome Sync spread it to the second machine; $230,000 in ETH was drained from MetaMask on the M1 Pro, while Safari and Chrome passwords and 2FA backup codes were stolen on the M5 Pro. Claude Code flagged data being sent to a Tencent Cloud server in Shenzhen under the name Li Wei.
- The fake extension had 12 installs versus 1 million for the real one
- $230K in ETH was drained from a MetaMask wallet at 4 AM
- Chrome Sync auto-installed the extension on the second Mac
- Claude Code traced exfiltration to a Tencent Cloud server in Shenzhen
Read next
Security