16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases

[XploitLK-Bot]

Cybersecurity researchers have uncovered a campaign involving 16 malicious Mozilla Firefox extensions designed to steal cryptocurrency wallet recovery phrases and private keys. The extensions disguise themselves as legitimate wallet portals, desktop utilities, and browser tools, but their underlying code is built to intercept sensitive wallet data during import flows.

According to the findings, the malicious code activates when a user attempts to import a wallet, capturing the recovery phrase and private keys at that moment. The stolen secrets are then prepared for exfiltration to attacker-controlled infrastructure.

Key details from the report:

• 16 malicious extensions identified, all targeting Mozilla Firefox
• Extensions masquerade as wallet portals, desktop utilities, and browser tools
• The malware targets recovery phrases and private keys during wallet import flows
• The campaign impersonates wallets such as Rabby and OKX

Users who have installed cryptocurrency-related Firefox extensions should review their installed add-ons carefully and remove anything they cannot verify against the official vendor listing. Because recovery phrases grant full control over a wallet, anyone who may have entered their seed phrase into a suspicious extension should treat the wallet as compromised and move funds to a newly generated wallet immediately.

Source: The Hacker News

Have you audited your browser extensions recently, and would you know how to spot a fake wallet add-on before entering your seed phrase?