Malicious Firefox Extensions Steal Crypto Wallet Recovery Phrases and Private Keys
What Happened — Socket’s threat researchers identified three malicious Firefox add‑ons that masqueraded as the popular Phantom, Jupiter, and Bitget crypto‑wallet extensions. The extensions were listed in the official Firefox Add‑ons store, read user input fields, captured pasted text, and even scanned the screen for displayed recovery phrases. When a victim entered a 12‑, 15‑, 18‑ or 24‑word recovery phrase or a private key, the extension logged the secret and sent it to a Telegram bot. The attacker then moved the stolen funds to hard‑coded payout addresses across multiple blockchains (Ethereum, BSC, Polygon, Solana, Bitcoin, etc.). All three listings have been removed from the store, but any user who installed them remains at risk.
Why It Matters for Trust & Control Assurance — The incident highlights the need for strong credential‑protection controls and continuous monitoring of third‑party software that can access secret keys.
Who Is Affected —
- Users of cryptocurrency wallets who install browser extensions.
- Crypto‑wallet providers that rely on browser‑based access.
Recommended Actions
- Remove any suspicious wallet extensions immediately.
- Instruct affected users to create a new wallet on a clean device and transfer assets.
- Enforce a policy that wallet extensions are installed only from official vendor links.
- Deploy endpoint protection that blocks unauthorized browser add‑ons.
- Conduct user‑awareness training on the dangers of entering recovery phrases in browsers.
Technical Notes
- Attack vector: Malicious browser extension (malware) distributed via the Firefox Add‑ons store.
- Data stolen: 12‑, 15‑, 18‑, 24‑word recovery phrases; Ethereum, Solana, and other private keys.
- Exfiltration method: Logged locally and sent to a Telegram bot, then used to move funds.
- Status: Extensions removed; remediation steps advised for any installed copies.