Fake Firefox wallets steal crypto recovery phrases and private keys

Three malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets were caught stealing recovery phrases and private keys, with one also fetching additional malicious code from an attacker-controlled server.

Socket’s Threat Research Team reports that all three extensions were available on Mozilla’s Firefox Add-ons store during the investigation but have since been removed.

The fraudulent listings used lookalike Unicode characters, copied branding, and separate developer accounts to appear legitimate. The Phantom impersonator reused the wallet’s ghost icon and claimed to be an official Firefox update, while the Bitget fake presented wallet branding despite carrying the internal name “TabFlow Pro.”

Phantom, Jupiter, and Bitget are established names in cryptocurrency wallets and trading. Socket noted that the genuine Phantom extension had five million Chrome Web Store users and approximately 83,000 daily Firefox users, giving attackers a recognizable brand to exploit.

Stealing secrets across browser pages

All three signed extension packages contained functioning stealers, meaning malicious code was already present in the versions submitted for Mozilla’s review.

The Phantom fake included an analytics.js stealer connected to its popup and onboarding screens. It also carried a loader in background/serviceWorker.js that retrieved a configuration from phantom[.]bonto[.]io/config, decoded the supplied payload, and executed it in browser pages.

The loader attempted to run inside the page’s own JavaScript environment, allowing access to page objects, and reapplied the cached payload as tabs finished loading.

The downloaded code collected input-field contents, monitored paste events, and searched displayed text for numbered recovery phrases. It recognized several common seed-phrase lengths and Ethereum and Solana private-key formats, and could intercept a Phantom wallet connection to collect its public address.

Jupiter’s trojanized background script stole recovery phrases and private keys during wallet imports, while a separate hook captured secrets from page inputs and clipboard activity. Bitget’s components scanned page content and extension messages, intercepted decrypted wallet seeds, and redirected users toward its local import screen.

Stolen information went to brand-specific subdomains under bonto[.]io. Socket also identified Coinbase- and Exodus-themed hosts with matching responses, although it did not locate corresponding Firefox listings.

Code prepared for an “approval flip”

The Phantom package unusually included server.js, the operator’s backend code, with functions to record stolen secrets, forward them to Telegram, and automatically transfer assets to hardcoded addresses across nine cryptocurrency networks.

A separate server-review.js returned an inactive configuration for Mozilla’s review. described switching to the live backend after approval, enabling the operator to activate or change the remotely delivered payload without submitting another extension version. However, that mechanism was additional to the stealers already bundled in the extensions.

Users should obtain wallet extensions through links on the wallet vendor’s official website. Anyone who exposed a recovery phrase or private key through these extensions should treat the wallet as compromised and transfer remaining assets to a new wallet created on a clean device.