Hackers Use Fake Firefox Wallet Extensions to Steal Crypto Recovery Phrases

Hackers have used 16 malicious Firefox extensions to target cryptocurrency users with fake wallet screens that capture recovery phrases and private keys.

The add-ons posed as wallet portals, desktop tools, and browser utilities, while hidden code attempted to send the secrets to attacker-controlled Cloudflare Workers.

The campaign copied interfaces from Rabby Wallet and OKX Wallet, turning familiar wallet import steps into traps. Mozilla had removed the malicious extensions from its marketplace by October 5, 2026.

However, removal does not protect anyone who already entered a recovery phrase or private key into a working version. Researchers from Socket.dev identified the malware and published their findings on October 7.

Their analysis found four large Rabby clones and 12 smaller OKX-style extensions. Eleven smaller packages loaded credential-stealing background scripts; one contained similar theft code but could not run it through its normal packaged workflow.

Socket linked the activity with high confidence to an August campaign based on shared code, infrastructure, and a common tracking marker.

The earlier Firefox wallet theft campaign also used fake wallet interfaces and Cloudflare Workers to collect secrets, showing how attackers can keep publishing related packages under changing names.

Hackers Use Fake Firefox Wallet Extensions

Each Rabby clone contained 1,114 files, including wallet import screens, account management code, and transaction interfaces.

Rather than building a simple phishing page, the operators copied a substantial wallet application and added theft functions. Some official Rabby links and DeBank service settings remained, helping the altered software look more convincing.

The stolen branding was inconsistent: the welcome screen still displayed Rabby Wallet, while other parts used a misspelled name. More importantly, malicious functions were placed directly after private-key and recovery-phrase import operations.

They accepted 12-word or 24-word phrases and 64-character hexadecimal private keys, copying the same secrets the wallet processed. This approach exploits trust in a familiar screen rather than proving a flaw in the real wallet service.

Similar fake crypto wallet screens have appeared in separate malware campaigns, where convincing recovery prompts persuade users to surrender secrets. Here, the copied application could continue its wallet workflow while the theft code ran alongside it.

The smaller extensions displayed an OKX-derived interface under generic portal branding. Their import form checked for exactly 12 or 24 words, then passed the entered phrase to a background handler.

That handler removed surrounding spaces, rejected empty input, and avoided sending repeated phrases already seen during the running session.

Secrets Sent Through Cloudflare Workers

The Rabby clones sent secrets inside GET request URLs, with a second request method available if the first failed. This exposed recovery material not only to the attacker’s endpoint but also to systems that record request URLs.

The active OKX-style handlers instead sent raw phrases in HTTPS POST requests containing JSON data. One packaged background script offered three sending methods: a browser beacon, a POST request, and an image-based GET fallback.

Its comments claimed that only a hash and word count left the device. Socket found that the payload contained the full phrase; the hash served only to prevent duplicate submissions.

The broken extension lacked the manifest entry needed to load its background script, and its interface sent a message the handler did not accept. That limits claims about its operation, not its intent.

Separate TronLink wallet impersonation attacks likewise show how copied wallet interfaces can become credential traps, although those attacks used different delivery and collection methods.

Every extension declared that it collected no data, contradicting the secret-handling code. The Rabby clones also requested broad browser access.

However, Socket’s static analysis did not establish a separate form-grabbing capability, so the confirmed finding remains wallet-secret theft rather than wider browsing-data collection.

Legitimate Rabby and DeBank domains retained in the packages are not campaign indicators. Anyone who entered a real phrase or private key into a working variant should treat the wallet as compromised.

Socket recommends removing the extensions, creating a new wallet on a clean device, moving assets, and revoking relevant token approvals. Changing the extension password cannot invalidate a stolen recovery phrase or private key.

Defenders should check extension inventories, browser profiles, synchronized add-ons, and network records against the indicators below.

Searches should match destination hosts, request patterns, hashes, and campaign markers without copying stolen phrases into alerts or case notes.

The secret-bearing field should be redacted. Preserve suspicious packages for investigation, but do not run them on an analyst’s normal workstation.

Indicators of compromise (IoCs):-

Network and Code Indicators

Shared File Hashes

Extension IDs and Package Hashes

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC