The extension employs various JavaScript scripts to manipulate users’ browsers while browsing targeted cryptocurrency websites. It can also customize the appearance of email services like Gmail, Hotmail and Yahoo to hide its activity involving the victim’s cryptocurrencies.

Source: Infosecurity