It's not an extension nor it is a virus.
It's something that each one of you can code up themselves with the proper resources. There is a pdf manual circling around from the Torum times.
Basically, this code/program/whatever can be attached to anything. Whether it's a game or app. that you download from your favorite Torrent website. Or a book from a sketchy website. Once you double-click it, it instantly disappears. The anti-virus won't detect a thing.
Once it's opened, it becomes a background process named whatever the creator named it. Could even be explorer.exe or Adobe Update. After re-starting your computer, it will reappear. Why? Because there are a few files that come along with this process and they instantly re-start the process if it has been closed. Those files can be found somewhere in your computer but since I don't remember where exactly, can't tell you nothing.
How it works for the creator (scammer):
They copy/paste their own (for an example) BTC address into the program/code. Then they choose an amount of addresses to be generated into a text file. For an example, 10000 addresses. Each one of those addresses will be associated with that one BTC address that belongs to the creator. Once that's done, they add those 10000 addresses to the so-called "virus". And then distribute it via Torrents, e-books, whatever and however they want to. After that, the victim downloads and infects his computer. If he doesn't notice it then the next time he tries to send or receive some BTC (BTC in this case but it can really be any currency), he copies the address, right? After pasting it in, one of those 10000 addresses will get pasted instead of the victim's real address. And the process/virus will paste in an address that looks as similar to the victim's original address as possible.
This is not an assumption of how it works. I know exactly what I'm talking about.
