TI Mindmap HUB
Threat Intelligence Report

Fake imToken Chrome Extension Steals Seed Phrases via Phishing Redirects

📅 March 7, 2026 📰 socket.dev 🔍 0 CVE(s) referenced

A malicious Chrome extension posing as a color tool uses lookalike branding and homoglyph tricks to impersonate imToken, redirecting victims to phishing sites that steal wallet seed phrases and private keys for immediate crypto theft.

vendor

Sign in to access the full report including:
detailed analysis, IOCs, MITRE ATT&CK mapping, and STIX bundle.

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap
🎯 IOC Extraction
⚔️ MITRE ATT&CK TTPs
📦 STIX 2.1 Bundle