backpackwebextension[.]com

PhishDestroy has completed a forensic investigation into the domain backpackwebextension.com, which was flagged as a generic phishing site impersonating the legitimate 'Backpack' Web3 wallet browser extension. The threat actor leveraged a spoofed domain to deceive users into downloading a malicious extension, likely designed to harvest cryptocurrency wallet credentials or drain digital assets. While no specific drainer kit artifacts were publicly disclosed, the domain's infrastructure suggests a typical phishing operation targeting users of Web3 applications.

This domain exhibited several malicious indicators during its active phase. VirusTotal analysis revealed detection by 4 out of 95 security vendors, while the domain resolved to IP address 198.251.84.236 and was registered through Sav.com, LLC on February 02, 2026. Additionally, the domain utilized a Let’s Encrypt SSL certificate to appear legitimate and was flagged by Google Safe Browsing (GSB) as well as two other blocklists. Notably, this domain was actively blocked by MetaMask and SEAL, indicating its presence on multiple threat intelligence platforms.

As of the latest assessment, backpackwebextension.com has been taken offline, reducing its immediate threat to users. Response actions by security vendors and browser extension platforms have contributed to its containment, though users are advised to remain cautious of similar impersonation attempts. The remaining risk is considered elevated due to the domain's prior visibility and the likelihood of threat actors recycling similar tactics. Users should verify the authenticity of browser extensions and wallet-related domains before interacting with them. Security teams are encouraged to monitor for any re-registration or re-activation of this domain.