16 Malicious Firefox Extensions Target Crypto Wallets to Steal Credentials

• •16 malicious Firefox extensions impersonate Rabby and OKX wallets.
• •Extensions steal recovery phrases and private keys, sending them to attacker-controlled domains.
• •Mozilla removed the extensions on October 5, 2026; users must create new wallets if compromised.

Researchers have identified 16 malicious Firefox extensions that impersonate popular cryptocurrency wallets, Rabby and OKX, to steal recovery phrases and private keys. These extensions masquerade as legitimate tools but intercept sensitive information during wallet import processes, sending it to attacker-controlled Cloudflare Workers. Four extensions are clones of Rabby Wallet, while the remaining twelve target OKX Wallet users. The campaign is a continuation of similar credential-stealing operations identified in August 2026. All malicious extensions were unpublished by Mozilla as of October 5, 2026. Users who interacted with these extensions should assume their wallets are compromised and create new wallets immediately. The malicious extensions utilize rotating package names and IDs to evade detection, with fifteen identified using the same domain for exfiltration.