Halborn, an ethical hacking firm devoted to blockchain security, has identified a critical web browser vulnerability coined “Demonic” which, if exploited, could allow unauthenticated attackers to steal victims’ secret cryptocurrency wallet recovery phrases (known as “seed” or “seed phrase”), allowing the threat actors to import the wallet to their own devices, stealing all of the cryptocurrency an NFTs in the wallet. The flaw, tracked as CVE-2022-32969, is described as an insecure permissions vulnerability impacting Firefox and Chromium-based cryptocurrency wallet browser extensions. The flaw exists in the “Restore Session,” feature of the browsers, which store on disk and repopulate any text entered into a non-password input field, so that if the site crashes, the user doesn’t have to reinput all of the generic form text again. It should be noted that for this attack to work, the victim has to have checked the “Show Secret Recovery Phrase” checkbox to view the seed during import, which is what triggers the local disk storage. The vulnerability itself stems from how browser wallet extensions like Metamask, Phantom, and Brave, use a non-password designated input field for users to enter their seed, meaning that it is stored locally on disk and cached in memory in unencrypted plaintext. This attack can be locally facilitated by physically stealing the victim computer, or remotely by establishing remote access. The flaw has officially been patched in all of the extensions, except for Brave who has yet to release an official statement about Demonic. CTIX analysts urge any readers utilizing these types of wallet browser extensions to ensure that they are running the latest update. Besides software security patching, there are also best practices that can make this kind of attack virtually impossible. Users with crypto wallets should always use full disk encryption so the attackers won’t be able to obtain the seed without first unencrypting the drive with the decryption key. As a general best practice, copying and pasting passphrases should be avoided at all costs, even if the user wallet has been patched for this flaw, due to the clipboard also being a very popular vector for pilfering seed phrases. The best defensive measure that cryptocurrency holders can employ remains using a “cold wallet,” which cannot be compromised because they are designed to be inaccessible from the internet. If any of our readers believe that they may have been impacted by this vulnerability, we recommend that they create a new account, and migrate all of their assets to that account immediately.