A malicious Google Chrome extension named 'Crypto Copilot' has been discovered to steal Solana funds by attaching hidden transfer instructions during transactions. Cybersecurity firm Socket revealed that the extension, which allows trading on the Solana blockchain via social media feeds, secretly extracts a fee from each transaction and transfers it to the creator's wallet. The extension uses the decentralized exchange Raydium to perform trades, adding a hidden transfer of at least 0.0013 Solana coins per transaction. This deceptive practice misleads users into authorizing both an exchange and a fund transfer without their knowledge. Despite having only 15 users since its release in June 2024, the extension highlights significant security risks within the browser extension ecosystem.