Socket’s Threat Research Team has outlined all the details.
The Crypto Copilot Chrome extension embeds Solana trading into X, but covertly adds an extra transfer that funnels value to the attacker.