xodus-extension[.]wixstudio[.]com

PhishDestroy has flagged xodus-extension.wixstudio.com as a malicious domain actively distributing a crypto drainer that masquerades as a legitimate XODUS browser extension. This lure tricks users into connecting their wallets, enabling the attacker to silently siphon cryptocurrency assets via malicious JavaScript payloads injected at transaction signing time. The threat is especially concerning because the domain leverages a legitimate WixStudio hosting platform, giving it an air of authenticity while serving hostile content. Investigations confirm the domain resolves to 34.144.206.118, a Google Cloud IP commonly associated with short-lived, high-risk endpoints used in crypto-draining campaigns. SSL certificates issued by Let’s Encrypt further mask the malicious intent by providing a false sense of security through valid encryption.

This domain was registered through Wix.com registrar on an unspecified date, making precise age determination difficult; however, VirusTotal currently returns 0 detections out of 95 engines, indicating it remains under the radar despite active exploitation. The hosting infrastructure sits behind a Google Cloud node, which often allows rapid provisioning and takedown circumvention. The absence of detections suggests either a very recent deployment or effective evasion techniques, such as dynamic content rotation or delayed payload activation. Given these indicators, the risk level is under investigation but remains ACTIVE, with potential impact to any user who interacts with the phony extension or website hosted at this domain.

If you have visited xodus-extension.wixstudio.com or downloaded any file from it, immediately disconnect your wallet, revoke any connected permissions using tools like revoke.cash or similar platform utilities, and scan your system with PhishDestroy’s browser extension or a reputable antimalware tool. Do not reconnect your wallet until you confirm all transactions are clean and no unauthorized transfers have occurred. Consider rotating private keys or moving assets to a newly generated wallet if exposure is suspected. Report the domain to PhishDestroy and your wallet provider for further analysis and blocklisting.