Security firm SlowMist has issued a warning about a high-risk phishing attack targeting TRON users. Attackers are using a fake TronLink Chrome extension, employing Unicode bidirectional control characters and Cyrillic homographs to impersonate the official name. This malicious extension dynamically loads phishing pages via remote iframes, enabling the theft of mnemonic phrases, private keys, Keystore files, and passwords. Stolen data is then transmitted in real-time through a Telegram Bot. Users are advised to uninstall any suspicious extensions immediately.