ChainCatcher 消息，慢雾发布安全预警称，发现一起针对 TRON 钱包用户的高危钓鱼活动。攻击者创建了假冒 TronLink 钱包的 Chrome 扩展程序，利用 Unicode 双向控制字符和西里尔字母同形异义字伪装品牌名称。安装后，该扩展通过远程 iframe 加载完整钓鱼页面，形成“外壳-核心分离”的凭证窃取链。
恶意扩展名称使用同形异义字伪装，其 Chrome 商店页面继承真实扩展的高用户数和好评，降低了审查门槛。本地代码极少，仅加载远程页面，使静态分析几乎无法检测恶意行为。远程钓鱼页面完美复刻官方 TronLink 网页钱包界面，窃取助记词、私钥、Keystore 文件和密码，并通过 Telegram Bot 实时回传。
内置反分析功能禁用右键、开发者工具、拖放和打印，并根据俄语用户的地理和语言设置重定向以规避检测。SlowMist 建议立即卸载可疑扩展，并清理本地存储、检查异常流量，如已输入凭证应立即创建新钱包并转移资产。
Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.