Fake Crypto Wallets in Firefox: How 16 Malicious Extensions Stole Recovery Phrases
Your browser extension store feels like a safe place, but it isn’t always. Security researchers at Socket recently uncovered 16 malicious Firefox extensions disguised as popular crypto wallets, and their only job was to steal the most valuable secret a crypto user owns: the recovery phrase.
What happened
The extensions posed as wallet portals, desktop utilities and browser tools. Four of them were clones of Rabby Wallet and the other twelve imitated OKX Wallet. They looked and behaved like the real thing until the victim tried to import an existing wallet. At that moment, the hidden code copied the recovery phrase or private key and sent it to a server controlled by the attacker, hosted on Cloudflare Workers. All but one of the extensions contacted the same domain pattern, which gave researchers a strong link between them.
Why this attack works
A recovery phrase is the master key to a wallet. Anyone who has it can move the funds without a password, without two-factor authentication and without the owner’s approval, and there is no bank to call and no way to reverse the transaction. The attackers also rely on a natural habit: people who want to use their wallet in a new browser search for an extension and import their phrase, so a convincing clone is all it takes.
This is not the first wave
According to the report, this campaign continues one that Socket documented in August 2026, when a larger set of malicious Firefox extensions used the same trick. The attackers keep rotating package names, version numbers, extension IDs and descriptions to avoid detection, while reusing the same wallet interface, the same credential-handling code and the same network infrastructure. Removing the extensions is a good first step, but new listings can appear under new names faster than they are taken down.
Part of a bigger browser-extension problem
The report places this campaign among other recent discoveries across Firefox, Chrome and Edge. Researchers have found an extension posing as a PDF identity tool that injected code into Google’s sign-in domain to steal session cookies, clusters of “productivity” extensions that harvested browsing data or redirected users to crypto phishing pages, and fake VPN extensions that routed traffic through attacker-chosen proxies. Others quietly captured users’ conversations with AI chatbots. The pattern is clear: extensions have deep access to what you see and type in your browser, and attackers have noticed.
What you should do
If you installed any of these extensions and entered a real recovery phrase or private key, assume the wallet is compromised. Create a new wallet on a clean device and move your assets to it as quickly as possible. Everyone else should install wallets only through the official website’s link rather than by searching the extension store, and check the publisher, reviews and install history before adding any extension. It also helps to review your installed extensions regularly and remove the ones you no longer use. A hardware wallet adds strong protection because it keeps your keys out of the browser entirely, and you should never type your recovery phrase into a site or extension unless you are restoring your own wallet from the official app. Organizations should audit the extensions in their managed browsers and use behavior-based monitoring to spot suspicious activity at runtime.
Final thoughts
Fake wallets succeed because they don’t need to break any encryption. They only need to convince you to hand over the key, so treat every extension as software with real access to your digital life and verify before you trust it.
Reference
Comments