15 Malicious Firefox Extensions Abuse Cloudflare Workers to Exfiltrate Crypto Wallet Secrets

Cybersecuritynews •Tushar Subhra Dutta • August 20, 2026

Firefox users are facing a coordinated campaign of malicious add-ons that masquerade as cryptocurrency wallets, themes, and simple browser tools. The extensions can trick victims into disclosing recovery phrases, private keys, login details, and clipboard data, placing digital assets and online accounts at immediate risk. Active since at least March 2026, the operation spans 77 […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Coordinated Campaign of Malicious Firefox Extensions Targets Crypto Users A coordinated campaign has been launched against Firefox users, involving malicious extensions that impersonate cryptocurrency wallets and tools. These extensions are designed to extract sensitive information, including recovery phrases, private keys, and clipboard data. The operation has been active since at least March 2026 and has affected a significant number of users, with reports indicating at least 40 different malicious extensions. Victims are at risk of losing their digital assets and online accounts due to these deceptive add-ons. The malicious actors are leveraging Cloudflare Workers to facilitate the exfiltration of data. Users are advised to be cautious and verify the legitimacy of extensions before installation. 10 sources 66

Extracted Entities

15 Malicious Firefox Extensions Abuse Cloudflare Workers to Exfiltrate Crypto Wallet Secrets

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (3)

Platforms (1)