Osiris Malicious Browser Extension Malware Link Swap
Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
Osiris marketed itself as a cutting-edge Web3 browser extension offering powerful anti-scam protection, with a sleek interface and customizable features. However, investigations by cybersecurity firm SlowMist revealed that it is actually a malicious tool designed to hijack download links, install malware, and steal sensitive user data including crypto assets and login credentials. Despite its claims of security, Osiris exploits trust to carry out targeted attacks, particularly on macOS users. The Web3 community, led by vigilant users like @0xmaoning and @Onefly_eth, played a key role in uncovering the threat. Though publicly exposed, Osiris remains available online, with little known about its operators or the fate of the stolen funds.[1][2][3][4]
About Osiris Browser Extension
OSIRIS claims to be a robust browser extension developed to offer powerful anti-scam protection for Web3 users. Designed with aggressive security features and an intuitive interface, OSIRIS promises to help shield users from malicious online traps, ensuring a safe and secure browsing experience across multiple platforms. Its focus is on creating the strongest protection available in the Web3 ecosystem.
The extension announces it will be available starting in June and is positioned as a critical tool for those active in decentralized web environments. OSIRIS emphasizes not just technical security but also user experience, aiming to align with users' personal styles and preferences through customizable themes like "Dark Spring Light" to "Set the Mood That Matches Your Vibe."
OSIRIS is part of a broader initiative involving STR8FIRE, which is working on tokenizing entertainment, suggesting an intersection of cybersecurity and digital media innovation. Users can stay informed or seek support through contact options like email, Twitter, and Telegram.
The Reality
The unfortunate reality about the Osiris browser extension is that it is a malicious tool masquerading as a Web3 security solution, actively targeting users in the cryptocurrency space. Promoted as a safeguard against scams and phishing, Osiris is actually a carefully designed piece of malware that exploits users’ trust to compromise their devices and steal sensitive information, including cryptocurrency assets and login credentials.
What Happened
Osiris is a wolf in sheep’s clothing, using the language and aesthetic of security to deceive and exploit.
| Date | Event | Description |
|---|---|---|
| May 22nd, 2025 | Fake Reviews Start Generating | The start of fake reviews on the Osiris malicious browser extension. |
| May 28th, 2025 6:51:05 AM MDT | Wolf In Sheep Clothing | SlowMist posts a detailed article of their analysis on their Medium page. |
| May 28th, 2025 7:10:00 AM MDT | SlowMist Tweet Posted | SlowMist posts a tweet which links to their Medium article explaining the Osiris browser extension and associated malware, which users may install under the false belief that Osiris is enhancing their browser security. |
Technical Details
According to a detailed investigation by the cybersecurity firm SlowMist, Osiris manipulates browser behavior through Chrome’s declarativeNetRequest API. Once installed, it fetches network rules from attacker-controlled servers, dynamically modifying legitimate download links on trusted websites—like Notion—to instead deliver malware. While the user believes they are downloading a safe file, they are actually installing harmful software. This sleight of hand is made more dangerous by the extension’s ability to spoof download sources in Chrome’s interface, hiding its true intentions.
The macOS variant of the malware, for example, disguises itself as a harmless installer that prompts users to drag it into the Terminal. This process secretly executes encoded commands that grant the malware elevated access. It then steals sensitive browser and keychain data, uploading it to attacker infrastructure. With this access, attackers can extract wallet keys, passwords, and potentially hijack the victim’s digital identity and assets.
Total Amount Lost
Specific figures detailing the total losses from Osiris-related incidents remain undisclosed.
The total amount lost is unknown.
Immediate Reactions
After being alerted by user @0xmaoning, SlowMist investigated and confirmed that Osiris was a malicious extension posing as a Web3 security tool. It was found to silently replace legitimate download links with malware, tricking users into installing harmful software that could lead to the theft of crypto assets. SlowMist publicly warned users, highlighting the extension's deceptive tactics and urging increased vigilance.
Ultimate Outcome
The broader community, including key figures like @0xmaoning and @Onefly_eth, played a critical role in exposing the threat. SlowMist praised their contributions and used the incident to stress the risks of blindly trusting tools marketed as security solutions. They encouraged users to avoid unknown extensions, rely on reputable security tools, and stay informed to protect themselves in the volatile Web3 landscape.
Total Amount Recovered
There does not appear to be any available recovery for any users affected by the malware.
There do not appear to have been any funds recovered in this case.
Ongoing Developments
Osiris is still generally available for download. Very little is known about who is behind the malware or what is happening with the stolen funds.
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ SlowMist - "Sometimes, solutions or tools that claim to enhance “security” may actually exploit the user’s trust to launch attacks. Today, @0xmaoning reached out to the SlowMist Security Team after spotting phishing behavior in the browser extension Osiris." - Twitter/X (Accessed May 28, 2025)
- ↑ A Wolf in Sheep’s Clothing: Analysis of the Osiris Malicious Browser Extension - SlowMist Medium (Accessed May 28, 2025)
- ↑ Osiris Homepage - Do Not Download (Accessed May 28, 2025)
- ↑ Osiris Browser Extension - Chrome Web Store (Do Not Download) (Accessed May 28, 2025)