Hackers Use Fake Firefox Wallet Extensions to Steal Crypto Recovery Phrases

Cybersecuritynews •Tushar Subhra Dutta • October 8, 2026

Hackers have used 16 malicious Firefox extensions to target cryptocurrency users with fake wallet screens that capture recovery phrases and private keys. The add-ons posed as wallet portals, desktop tools, and browser utilities, while hidden code attempted to send the secrets to attacker-controlled Cloudflare Workers. The campaign copied interfaces from Rabby Wallet and OKX Wallet, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

16 Malicious Firefox Extensions Target Crypto Wallets to Steal Credentials A coordinated campaign has been identified involving 16 malicious Firefox extensions that impersonate popular cryptocurrency wallets, Rabby and OKX, to steal recovery phrases and private keys. The extensions, which masquerade as legitimate wallet portals and browser tools, intercept sensitive information during wallet import flows and send it to attacker-controlled Cloudflare Workers. Mozilla removed these extensions on October 5, 2026, but users who entered their recovery phrases or private keys are advised to assume their wallets are compromised. The campaign is linked to a previous wave of crypto-theft targeted extensions identified in August 2026. Four of the extensions are clones of Rabby Wallet, while the remaining twelve imitate OKX Wallet. The malicious extensions utilize deceptive branding and retain links to official wallet applications, making them less conspicuous. Users are urged to create new wallets from clean environments and transfer their assets immediately. 5 sources 71

Extracted Entities

Hackers Use Fake Firefox Wallet Extensions to Steal Crypto Recovery Phrases

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (2)