Three malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget to steal cryptocurrency wallet recovery phrases and private keys.
The campaign combines deceptive branding, bundled credential stealers, and remotely delivered JavaScript, with stolen information routed through infrastructure under bonto[.]io.
All three listings were removed before Socket published its findings on October 27, 2026.
Phantom’s impersonator advertised itself as “OFFICIAL PHANTOM WALLET (Firefox Update),” while Jupiter claimed it was “Built by Jupiter Exchange.” Bitget branding concealed an extension internally named “TabFlow Pro.”
The Phantom impersonator, add-on ID 3092199, contained a loader appended to background/serviceWorker.js.
Disguised as an optional analytics component, it reconstructed phantom[.]bonto[.]io from character codes and requested instructions from its /config endpoint.
The response supplied an activation flag and Base64-encoded JavaScript. After decoding, the extension cached the payload locally.
It injected it into browser tabs, prioritizing the page’s main execution environment before falling back to an isolated context. Injection recurred when tabs finished loading and during installation or browser startup.
This design allowed operators to change remotely delivered code without submitting another extension version.
Socket Researchers said that, the attackers used Unicode homoglyphs, visually similar characters that mimic legitimate wallet names, alongside copied icons and marketing text.
Cryptocurrency Wallets Targeted
Socket observed an active configuration serving a 4,029-byte payload. Crucially, remote delivery was supplementary: all three signed extensions already contained complete, operational stealers within the packages Mozilla reviewed.
The Phantom payload access inspected input fields, textareas, paste events, and focus changes. It also scanned visible page text for numbered recovery phrases, recognizing selected seed-phrase lengths and private-key patterns associated with Ethereum-compatible networks and Solana.
Main-world execution additionally enabled interception of Phantom’s injected Solana provider to collect connected public keys. Captured information was transmitted as JSON.
Jupiter’s impersonator, ID 3092666, bundled a trojanized background.js that exfiltrated mnemonics and private keys during wallet imports.
A separate hook.js collected secrets from page inputs and clipboard activity, sending data to jupiter[.]bonto[.]io.
Bitget’s impersonator, ID 3092059, combined page scanning with a background worker that intercepted wallet storage as seeds were decrypted. It also redirected tab creation toward a local import screen.
Both components transmitted stolen material to bitget[.]bonto[.]io.
Socket’s technical investigation identified additional provisioned hosts at coinbase[.]bonto[.]io and exodus[.]bonto[.]io, although corresponding Firefox listings were not located.
Each confirmed malicious extension originated from a separate disposable developer account.
Phantom’s package also included Node.js backend code designed to log secrets, forward them through Telegram, and drain assets across nine blockchain networks.
A separate review server returned inactive configurations, documenting an intended post-approval switch. These backend files were bundled artifacts, not evidence that Node.js executed inside Firefox.
Socket additionally found AI jailbreak instructions in CLAUDE.md files, suggesting attempted AI-assisted development or review manipulation without establishing attribution. Reported wallet losses remained unverified.
Socket recommends installing wallet extensions only through official vendor websites. Anyone who exposed a recovery phrase or private key should immediately transfer assets to a newly generated wallet on a clean device and treat the original wallet as compromised.
IOCs
| Category | Indicator |
|---|---|
| Network Indicator | bonto[.]io |
| Network Indicator | phantom[.]bonto[.]io |
| Network Indicator | jupiter[.]bonto[.]io |
| Network Indicator | bitget[.]bonto[.]io |
| C2 Endpoint | https://phantom[.]bonto[.]io/config |
| C2 Endpoint | https://phantom[.]bonto[.]io/ |
| C2 Endpoint | https://jupiter[.]bonto[.]io/ |
| C2 Endpoint | https://bitget[.]bonto[.]io/ |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
