As cited
Copy frozen at (site build).
threat intel
Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets
Socket's Threat Research Team discovered three malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget crypto wallets using Unicode homoglyphs and copied branding to steal recovery phrases and private keys. The Phantom variant employed a loader that fetches a second-stage stealer from a remote server, while Jupiter and Bitget variants bundled their stealers directly; all exfiltration routed to subdomains of bonto[.]io controlled by the same operator. Mozilla removed all three listings after they were identified, though the extensions had been live on Firefox Add-ons during analysis with low but active daily user counts.
Why it matters: Crypto users and wallet providers are targeted; anyone who installed these extensions and entered or revealed a recovery phrase or private key had those secrets sent to the attacker, who can now drain any assets in the compromised wallets. Practitioners should block the bonto[.]io apex and subdomains, monitor for similar extension patterns using runtime code injection, and advise users to move funds from any wallet secrets entered into unfamiliar extensions.
- Source published
- First seen by Cybersecurity Tracker