Malicious Firefox Extensions Impersonate Crypto Wallets to Steal Keys
Three malicious Firefox extensions disguised as popular crypto wallets—Phantom, Jupiter, and Bitget—were discovered on the official Firefox Add-ons store, designed to steal users' private keys and recovery phrases.
Researchers at Socket.dev have uncovered a sophisticated phishing campaign operating within the official Firefox Add-ons store, where three malicious browser extensions masqueraded as legitimate cryptocurrency wallets: Phantom, Jupiter, and Bitget. These fake add-ons were meticulously crafted to mimic the branding, icons, and marketing materials of their authentic counterparts, aiming to trick unsuspecting users searching for secure wallet solutions into installing malware.
The primary objective of these malicious extensions was to steal users' most sensitive cryptocurrency credentials, including recovery phrases and private keys. Possession of these secrets grants complete control over a cryptocurrency wallet and its associated funds. The extensions were designed to capture this information directly from user input fields and recovery phrase screens, exfiltrating the stolen data to attacker-controlled servers located on subdomains of bonto[.]io.
One of the most concerning aspects of this campaign is the advanced evasion techniques employed. The fake Phantom extension, for instance, included a hidden loader within its background script. This loader was capable of altering its behavior after the extension passed Mozilla's review process. It would initially respond harmlessly during the review phase and then activate the full data-stealing payload once deployed, a tactic designed to bypass automated security checks.
The stolen data targeted various recovery phrase lengths (12, 15, 18, and 24 words) and common private key formats for Ethereum and Solana. The malware actively monitored web pages, capturing data entered into text boxes, paste events, and the grid-based recovery phrase screens that wallets typically present. This captured information was then transmitted to the attackers' servers in JSON format.
Socket.dev noted that the Phantom extension also included a complete drainer backend, allowing it to not only steal secrets but also to move funds directly to attacker-controlled addresses across multiple blockchains, including Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana, and Bitcoin. This indicates a highly organized operation with the capability for immediate financial exploitation.
Further investigation revealed that the attackers had provisioned subdomains for other popular wallets, such as Coinbase Wallet and Exodus, suggesting an intent to expand the campaign. The use of throwaway developer accounts for each malicious extension and the inclusion of AI jailbreak prompts in some packages hint at the use of AI in malware development and evasion strategies.
This campaign is reminiscent of previous efforts, such as the "Offside Wallet Theft Factory," which also involved a large number of malicious Firefox add-ons. Users are strongly advised to exercise extreme caution, installing extensions only from official links provided by wallet developers and never entering recovery phrases on web pages. If a user suspects they have compromised their wallet, they should immediately create a new wallet on a secure device and transfer their funds, as simply deleting the extension does not secure leaked credentials.