Malicious Firefox Extensions Impersonate Crypto Wallets to Harvest Recovery Phrases
What Happened — Researchers identified 16 malicious Mozilla Firefox extensions that masquerade as cryptocurrency wallets, desktop utilities, or browser tools. Their code intercepts wallet recovery phrases and private keys during import flows and exfiltrates the secrets to attacker‑controlled servers.
Why It Matters for Trust & Control Assurance
- This scenario tests the control objective of third‑party software oversight – ensuring only vetted extensions are allowed and continuously monitored.
- Continuous control‑assurance programs need to capture evidence of extension inventory, enforce whitelist policies, and log anomalous data‑exfiltration attempts.
- Verisq’s Vendor/Third‑Party Risk Management capability provides the evidence collection and real‑time monitoring needed to demonstrate due diligence.
Who Is Affected – Cryptocurrency users, fintech platforms, and any organization that permits browser extensions on employee workstations (financial services, technology SaaS, cloud‑infrastructure providers).
Recommended Actions
- Conduct an immediate inventory of all installed browser extensions across your environment.
- Enforce a strict whitelist of approved extensions and block unsigned add‑ons.
- Deploy endpoint monitoring that logs extension activity and alerts on attempts to capture or transmit credential‑like data.
- Review and update your third‑party risk policy to include browser‑extension supply‑chain risk.
Source: The Hacker News
Technical Notes
- Attack vector: malicious third‑party browser extensions (supply‑chain).
- Data types stolen: cryptocurrency wallet recovery phrases, private keys (high‑value credential data).
- No known CVE; threat relies on social‑engineering and extension marketplace abuse.
Source: The Hacker News