Malicious Firefox extensions impersonate crypto wallets and steal keys

Socket's threat researchers found three malicious Firefox browser extensions listed on Firefox Add-ons that impersonated popular crypto wallets, according to Malwarebytes. The fake add-ons targeted wallet recovery phrases and private keys, and at least one variant logged captured secrets and automatically moved funds to attacker addresses.

What the malicious Firefox extensions did

According to Malwarebytes, the fake extensions impersonated Phantom, Jupiter, and Bitget. The extensions were able to search for 12-, 15-, 18-, and 24-word recovery phrases and for Ethereum and Solana private keys. They could read form fields, detect pasted text, and scan screens that display recovery phrases.

Malwarebytes reports the Phantom impersonator sent captured secrets to a backend that forwarded them to a Telegram bot, then moved funds to hardcoded payout addresses. Those payout addresses covered Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana, and Bitcoin. The Phantom variant could capture a recovery phrase both when it was typed and when it was shown on a reveal screen.

The researchers found the three listings live on Firefox Add-ons while they analyzed the threat, and the listings have since been removed, Malwarebytes says.

Why this matters to your organization

A recovery phrase or private key is a bearer secret: whoever has it controls the wallet and can transfer assets. Malwarebytes explains that a crypto wallet does not hold coins itself, it only manages the keys that let you access and spend them. If an employee or volunteer imports a wallet using a copied recovery phrase, an attacker who captured that phrase can move funds without needing passwords or logins.

For organizations that accept cryptocurrency donations, hold funds for programs, or use crypto for payments, a compromised recovery phrase can lead to immediate and irreversible loss. Even for individuals associated with your organization, a compromised key can create operational disruption and extra work to recover access and funds.

How to check for malicious Firefox extensions and what to do

If you use Firefox at work or on a device that accesses organizational assets, follow these steps immediately, based on Malwarebytes guidance:

• Open Firefox and look for unfamiliar or recently added wallet extensions. Remove any you do not recognize using the extension's three-dot menu and choosing Remove.
• If you entered a recovery phrase or private key into an extension or website, create a new wallet on a clean device and move your assets right away. "Treat the old wallet as compromised," Malwarebytes advises.
• Install wallet extensions only from the wallet vendor's official website link, not from store search results, which can be spoofed.
• Watch for warning signs in an add-on listing, for example asking to access data on all websites or lacking a privacy policy; the fake Phantom listing displayed those signs, Malwarebytes notes.
• Use an up-to-date, real-time anti-malware solution that blocks malicious websites and downloads.
• Never enter your recovery phrase on a website, Malwarebytes warns: "Never enter your recovery phrase on a website." Enter it only in the official wallet app when restoring.

If your organization wants a simple check of what an attacker can already learn about your site and how it could be used as an attack surface, see our site scan page: /security.html

Indicators and technical details reported

Malwarebytes lists the specific add-on IDs and infrastructure it found while reporting the incidents. The malicious add-ons identified were:

• Phantom impersonator: add-on ID 3092199
• Jupiter impersonator: add-on ID 3092666
• Bitget impersonator: add-on ID 3092059

Reported subdomains included bonto[.]io variants such as bonto[.]iophantom[.]bonto[.]io and coinbase[.]bonto[.]io among others. Malwarebytes also listed IP addresses observed during analysis.

If your IT or security team tracks IOCs, review these identifiers in your endpoint and browser telemetry to see if any match activity on your devices.

Practical next steps for small teams

• Audit Firefox extensions on any machines that touch crypto wallets or donations, and remove unknown extensions.
• If a recovery phrase was exposed, create new wallets on clean hardware, move funds, and treat old wallets as compromised.
• Centralize sensitive wallet operations where possible, and limit the number of people who can import or export recovery phrases.
• Train staff and volunteers that wallet support will never ask for a recovery phrase, and that phrases belong offline, not pasted into web forms.

Malwarebytes provided these findings from Socket's threat research. Follow the removal and recovery steps above if you suspect exposure, and keep browser extensions and anti-malware current to reduce similar risks.