Malicious Firefox Extensions Target Cryptocurrency Wallets in Sophisticated Phishing Campaign On October 7, 2026, cybersecurity firm Socket disclosed the discovery of 16 malicious Firefox extensions designed to steal cryptocurrency wallet recovery phrases and private keys. The extensions, which impersonated legitimate wallet tools like Rabby Wallet and OKX, were unpublished by Mozilla by October 5, 2026, following Socket’s investigation. ### How the Attack Worked The extensions masqueraded as wallet portals, desktop utilities, and browser tools, embedding malicious code within otherwise functional interfaces. Key details include: - Deceptive Branding: Four extensions cloned Rabby Wallet, using the misspelled name "Raabby WaIIet" and retaining legitimate assets from DeBank to appear authentic. Each contained 1,114 files, including wallet import screens and transaction interfaces, making the malicious components harder to detect. - Secret Theft Mechanisms: The extensions intercepted 12- or 24-word recovery phrases and 64-character private keys during wallet imports. Malicious hooks in background.js and 977.js captured secrets after operations like `importPrivateKey` and `createKeyringWithMnemonics`, transmitting them to attacker-controlled Cloudflare Workers via HTTPS. - Exfiltration Methods: Stolen data was sent in GET/POST requests to domains like `silent-wind-get.icy-star-f45c[.]workers[.]dev`, often including the raw secret in the URL a risky practice that could expose it in server logs. Some extensions used navigator.sendBeacon or image-pixel GET fallbacks as redundant exfiltration paths. - Manifest Mismatch: Despite declaring "none" for data collection permissions in their manifests, all extensions contained code to transmit wallet secrets, highlighting deliberate deception. ### Scope and Attribution - 15 of the 16 extensions had functional theft mechanisms, while one ([email protected] v2.1) failed due to a missing manifest declaration, preventing its background script from loading. - The campaign reused shared infrastructure, code, and a campaign marker (`EQOx7EIPZSNi`) from Socket’s August 2026 investigation, which identified 77 related extensions (40 malicious, 37 deceptive). Researchers assessed this as a continuation of the same operation, though no specific threat actor was named. - Smaller extensions mimicked OKX Wallet onboarding screens, using official OKX help links to bolster credibility. ### Impact and Recommendations Users who imported wallets via these extensions should assume compromise, as exposed recovery phrases and private keys cannot be invalidated by password changes. Affected individuals were advised to: - Remove the extensions immediately. - Create new wallets from a clean environment. - Transfer assets to secure wallets. Defenders can block the identified Cloudflare Worker endpoints and hunt for the campaign’s indicators of compromise (IOCs), including hashes and the marker `EQOx7EIPZSNi`. Telemetry should redact the `w` parameter to avoid logging stolen secrets. Notably, legitimate Rabby and DeBank domains are not malicious, and broad permissions alone do not indicate additional data theft.