platform-extensions[.]wixstudio[.]com

This domain, platform-extensions.wixstudio.com, operates as a fraudulent browser extension distribution point specifically designed to deploy crypto drainer malware. Analysis indicates the site mimics legitimate extension marketplaces, tricking users into installing malicious add-ons that silently monitor cryptocurrency transactions and redirect funds to attacker-controlled wallets. The threat primarily targets users of decentralized finance platforms and cryptocurrency wallets, with observed campaigns focusing on Chrome and Firefox extension stores. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to IP address 34.144.206.118 and was registered through GoDaddy.com, LLC on December 17, 2016, suggesting potential domain repurposing from an older, legitimate service. Security vendors have flagged this domain on five independent blocklists, while VirusTotal reports 12 out of 95 security engines detecting malicious activity. The site employed a Let's Encrypt SSL certificate, which while providing encryption, does not validate legitimacy. Notably, the domain has been blocked by multiple cryptocurrency security platforms, indicating specialized targeting of digital asset holders. Users who visited platform-extensions.wixstudio.com or installed any purported browser extensions from this domain should immediately revoke all extension permissions and perform a full system scan using updated security tools. All cryptocurrency wallet sessions should be terminated, and users should verify no unauthorized transactions have occurred. Browser profiles should be reset to factory defaults, and all stored credentials should be changed from a separate, secure device. Given the crypto drainer functionality, affected users must assume all wallet addresses and private keys exposed during the period of compromise are permanently compromised and should migrate funds to new wallets using fresh seed phrases. The domain's current offline status does not eliminate the risk to previously exposed systems.