Solana DeFi 用户警告针对 Memecoin 持有者的新恶意软件

Jupiter 是一家 DEX（去中心化交易所）聚合商，它警告用户注意一种新的恶意软件，该恶意软件被打包为基于 Chrome 的扩展程序，名为 Bull Checker。

A new malware, disguised as a Chrome-based extension and named Bull Checker, has been targeting Solana-based DeFi users, leading to their assets being stolen. Jupiter, a DEX (decentralized exchange) aggregator, has warned users about this malicious extension.

一种新的恶意软件伪装成基于 Chrome 的扩展程序，名为 Bull Checker，一直针对基于 Solana 的 DeFi 用户，导致他们的资产被盗。 DEX（去中心化交易所）聚合器 Jupiter 已向用户发出有关此恶意扩展的警告。

The Bull Checker extension was reportedly advertised to show all the holders of any memecoin, and several Solana-based DeFi users encountered their assets being drained after installing the extension. As Jupiter's user base experienced and voiced similar incidents, the DEX aggregator investigated to find the source of the hacks. In an X post, it revealed its findings.

据报道，Bull Checker 扩展的广告显示了任何 memecoin 的所有持有者，一些基于 Solana 的 DeFi 用户在安装该扩展后遇到了资产被耗尽的情况。由于 Jupiter 的用户群经历并表达了类似事件，DEX 聚合器进行了调查，以找到黑客攻击的根源。在一篇 X 帖子中，它透露了其发现。

"After extensive investigation, we have identified a malicious Chrome extension called “Bull Checker” that had targeted users on several Solana-related subreddits," the post stated. It further highlighted that those behind the extension advertised the product on Reddit, attempting to lure users by showing how they can make thousands of dollars with the extension.

帖子称：“经过广泛调查，我们发现了一个名为“Bull Checker”的恶意 Chrome 扩展程序，它的目标是几个与 Solana 相关的 Reddit 子版块上的用户。”它还进一步强调，该扩展程序背后的人在 Reddit 上宣传该产品，试图通过展示如何通过该扩展程序赚取数千美元来吸引用户。

"Users with this extension would interact with the dApps as per normal, have the simulation show up as normal, but have the possibility of their tokens being maliciously transferred to another wallet upon transaction completion," the post explained. It also added, "If you have this extension (or similar extensions with extensive permissions you cannot trust), please remove it immediately."

该帖子解释说：“使用此扩展程序的用户将正常与 dApp 进行交互，模拟显示正常，但交易完成后他们的代币有可能被恶意转移到另一个钱包。”它还补充说，“如果您有此扩展程序（或具有您无法信任的广泛权限的类似扩展程序），请立即将其删除。”

Upon installation, Bull Checker asks users for permission to read and change data, which should serve as a warning sign. However, many users might not notice this detail. Extensions that are safe to use typically only ask to read data. By allowing Bull Checker to modify data, it can manipulate recipient addresses on transactions, diverting funds from crypto transfers to a bad actor's wallet.

安装后，Bull Checker 会询问用户读取和更改数据的权限，这应作为警告标志。不过，很多用户可能没有注意到这个细节。可以安全使用的扩展通常只要求读取数据。通过允许 Bull Checker 修改数据，它可以操纵交易中的收件人地址，将资金从加密货币转移到不良行为者的钱包。

What's concerning about this malware is that the crypto drainer passes all simulation checks and cannot be detected as a tool developed and used by malicious entities. In a detailed report, Jupiter's pseudonymous founder, known as Meow, wrote, "Bull Checker is supposed to be a read-only extension that allows you to view the holders of memecoins. There should be no need for an extension like this to read or write data on all websites."

该恶意软件令人担忧的是，加密货币排水器通过了所有模拟检查，并且无法被检测为恶意实体开发和使用的工具。 Jupiter 的化名创始人 Meow 在一份详细报告中写道：“Bull Checker 应该是一个只读扩展程序，允许您查看模因币的持有者。应该不需要像这样的扩展程序来读取或在所有网站上写入数据。”

The report also includes advice for those interacting with offerings promoted in online communities: "Do not trust something just because someone mentioned it on Reddit or other media and it has many upvotes. Astroturfing and social engineering are very real."

该报告还为那些与在线社区推广的产品互动的人提供了建议：“不要仅仅因为有人在 Reddit 或其他媒体上提到某件事并且得到了很多支持就相信某件事。Astroturfing 和社会工程是非常真实的。”