Malicious Firefox Extensions Target Crypto Wallets to Steal Secrets

• •Three fake Firefox extensions impersonated popular crypto wallets to steal sensitive data.
• •The malicious extensions were available on Firefox Add-ons and have been removed post-discovery.
• •Attackers used Unicode homoglyphs and branding to deceive users into downloading the extensions.

A cluster of malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets has been identified, designed to steal recovery phrases and private keys. These extensions utilized Unicode homoglyphs to mimic legitimate wallet names and branding, making them appear authentic. Socket's Threat Research Team discovered that all three extensions were available on Mozilla's Firefox Add-ons store during their investigation but have since been removed. The Phantom impersonator included a loader that fetched additional malicious code from an attacker-controlled server, while the other two extensions contained built-in stealers. The stolen information was routed to subdomains under bonto[.]io. The campaign exploited the popularity of these wallets, which have millions of users across platforms. The malicious packages were signed, meaning they passed Mozilla's review process, allowing the attackers to execute their payloads in the browser environment.