Four crypto extensions read session tokens from inside the tabs where traders are already logged in

The module Socket names, `vamp/axiom-fetch-intercept.js`, never attacks Axiom Trade or Padre ^[12]. It runs inside pages where the victim is already authenticated and reads what that origin hands to any script on it ^[12]. On Padre the collector checks `localStorage` first, for `padreV2-session`, `padreV2-stamper` and `padre-v2-bundles-store-v2`, and tries to recover the Firebase access token ^[13]. When the token is not there, it opens `firebaseLocalStorageDb`, the default IndexedDB persistence for Firebase Auth, and searches for `stsTokenManager.accessToken` ^[14]. A telemetry collector does not need a second lookup path aimed at one named token field; Socket reads that fallback as deliberate recovery of authenticated session material ^[21].

The Axiom path is the same idea with the app's own API doing the work. The code checks whether the user is authenticated, then uses the live session to query Axiom's user and wallet endpoints, collecting authenticated user information along with `bundleKey`, `sBundles` and `eBundles` ^[15]. Those requests carry the victim's credentials because they are the victim's requests. Output goes to Vercel deployments the operator controls ^[4]. The exfiltrated object also carries a hard-coded `telegramId` of 7680513699 and `location.href`, in a field called `bookmarkData` ^[16], which is either sloppiness or a sense of humour.

The linkage between the six listings is code-level rather than circumstantial. The collection module is byte-identical across Chrome's J7Tracker, Chrome's VREO and the Firefox build of VREO ^[3]. GhostApe and GhostApe Color share an exact binary image ^[9]. GhostApe kept MockApe's API references, internal identifiers, version lineage and the legitimate MockApe Chrome Web Store ID ^[8], and archived marketplace data puts both GhostApe listings in the same historical Chrome publisher portfolio as J7Tracker and VREO ^[7].

On population, Socket cites more than 47,000 daily active on-chain Axiom traders by early August 2026 ^[17], and public reporting of more than 15 billion dollars of Axiom volume across more than 650,000 wallets by mid-2025 ^[18]. That works out to roughly 23,000 dollars of flow per wallet over that period ^[20]. Padre had cleared more than 2.7 billion dollars cumulatively by late October 2025 and held about 4 to 5 percent of Solana's trading-bot market ^[19]. Those figures describe the target population, not the victim set. For them to describe exposure, you would need install counts, and the report gives none for any of the six extensions ^[22].

The useful question here is what happens after a listing gets flagged, not whether it does. Uninstalling stops collection, but a Firebase access token posted to a Vercel endpoint last week stays valid regardless. The lever that closes this is on the application side: invalidate the sessions, rotate the wallet bundle material. Socket says it reported Orbit Tracker to the Mozilla Security Team and that the extension was still live at publication ^[11], and the writeup does not say Axiom or Padre invalidated affected sessions ^[23]. The real inventory is a list of origins where an installed extension can read a bearer token, and every logged-in trading tab is on that list.