Sixteen Malicious Firefox Extensions Caught Stealing Crypto Wallet Secrets

Mozilla has removed sixteen malicious Firefox extensions identified for stealing cryptocurrency recovery phrases and private keys. Security researchers at Socket discovered these malicious packages, which impersonated legitimate platforms by cloning code from Rabby Wallet and mimicking the interface of OKX Wallet. These fraudulent extensions exfiltrated sensitive credential data directly to attacker-controlled servers, posing a significant risk to digital asset security. Although Mozilla unpublished the compromised extensions by early October 2026, the removal does not automatically protect users who previously installed them. The investigation linked this activity to a broader, ongoing crypto-theft campaign characterized by shared infrastructure and specific credential-stealing techniques. Because the malicious clones often retained original branding and interface elements, they successfully deceived unsuspecting users. This incident highlights the persistent dangers of supply chain attacks within browser ecosystems and the sophistication of modern phishing campaigns. It serves as a critical reminder for users to verify the authenticity of browser extensions before managing private keys. For the cybersecurity industry, the event underscores the necessity for more rigorous vetting processes and enhanced detection mechanisms to protect decentralized finance users from increasingly deceptive, impersonation-based threats targeting high-value digital assets. --- 📰 Read the full article here 🌐 Visit https://cyberinsider.com