As cited
Copy frozen at (site build).
threat intel
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials
Socket Threat Research disclosed 16 malicious Firefox extensions that impersonate popular cryptocurrency wallets, including four Rabby clones and twelve OKX clones, to steal recovery phrases and private keys during import workflows. The extensions intercept wallet credentials and send them to attacker-controlled Cloudflare Workers infrastructure, reusing campaign markers, shared code, and network endpoints consistent with an operation identified in August 2026. Mozilla unpublished all malicious extensions as of October 5, 2026, and users who entered real recovery phrases or private keys into any variant should create new wallets from clean devices and move assets immediately.
Why it matters: Cryptocurrency wallet users are at immediate risk of total account compromise if they installed any of these 16 extensions and imported real credentials; affected users must abandon compromised wallets and migrate assets without delay, as changing only the extension password does not protect stolen seed phrases or private keys.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials
Socket Threat Research disclosed 16 malicious Firefox extensions that impersonate popular cryptocurrency wallets, including four Rabby clones and twelve OKX clones, to steal recovery phrases and private keys during import workflows. The extensions intercept wallet credentials and send them to attacker-controlled Cloudflare Workers infrastructure, reusing campaign markers, shared code, and network endpoints consistent with an operation identified in August 2026. Mozilla unpublished all malicious extensions as of October 5, 2026, and users who entered real recovery phrases or private keys into any variant should create new wallets from clean devices and move assets immediately.
Why it matters: Cryptocurrency wallet users are at immediate risk of total account compromise if they installed any of these 16 extensions and imported real credentials; affected users must abandon compromised wallets and migrate assets without delay, as changing only the extension password does not protect stolen seed phrases or private keys.
- Source published
- First seen by Cybersecurity Tracker