Crypto theft campaign hits Firefox users with wallet clones

[_act_]

Over 40 fake Firefox extensions impersonating popular crypto wallets have been noticed since April of this year. Just as the usual ones, they are copying the open source codes of the original apps which makes it easy for the bad actors, they will include the malicious code after.

Another thing is that some of the extensions have good reviews already, unlike before that they may not have any review or have just little reviews. It was reported that one of the fake ads have hundredsof fake five-star reviews.

It is suspected that the bad actors are Russians because Russian-language comments are in the code and metadata found in a PDF file retrieved from a malware command-and-control server involved in the incident

They are impersonating wallet tools such as Coinbase, MetaMask, Trust Wallet, Phantom, Exodus, OKX, MyMonero, Bitget and others. Once installed, the malicious extensions are designed to steal users’ wallet credentials.

https://cointelegraph.com/news/over-40-crypto-stealing-firefox-extensions-discovered

If hackers now have malicious extensions with hundreds of good reviews, we really need to be more careful. My device for bitcoin, other crypto, banks other money related apps is not used for something like apps and extensions download. Also get cold wallet for high amount of coins instead.

It is also good to know the official sites of the apps and extensions and download there directly.

[albon]

This is a good warning for beginners, especially those who used the Firefox browser and don't have a hardware wallet. Thank you for sharing this.

As for me, I don't use this browser; I use Google Chrome.. I also know that there are many malicious browser extensions on the Chrome Web Store. Personally, I always use official websites to install these extensions and don't rely on searching through the extension store , because the danger also lies in the large number of positive reviews that can easily be bought or written by the owners of the browser extension themselves.

Therefore, caution is required when installing any crypto wallet extension,, as they are targeted. Avoid randomly installing extensions that we don't need. Such an exension could steal data saved in the browser, and it can also steal the wallet’s secret seed phrases, as mentioned in the article.

[SmartGold01]

It is also good to know the official sites of the apps and extensions and download there directly.

I think I came across this news in flash headline on a browser that usually gives me a highlighted update about the recently happening in cryptocurrency space and to bitcoin at large.
To me those who are targeted are those that are very lazy to make findings and even have to download the app from the right sources than just trying to get their extension, one thing for sure is that we have to be vey careful on how we go about with extension because most of the people who are mostly targeted are all extension based users, so to any extension I am installing I need to make due diligence to know if its safe for me. Again we are also advisable not to save our credential automatically to our browser as autosave password, this extension get access to our passwords manager.

[Moreno233]

This is a very disturbing news because people can easily fall for this type of security concern. Firefox is not one of the browser I trust given their history of being porous and a soft target for criminals, there are still a good number of people that use the browser. I think the basic safety measures of using only official website for downloads should be able to fix this and only lazy or people who ignore that will be victim of this threat. Scammers are really working overtime to achieve their aim which is to steal, we should be careful out there.

[tabas]

Over 40 fake Firefox extensions impersonating popular crypto wallets have been noticed since April of this year. Just as the usual ones, they are copying the open source codes of the original apps which makes it easy for the bad actors, they will include the malicious code after.

It's always been the extensions that users are downloading and entrusting with their funds without doing research before installing them. While many might be confident that they're not going to fall on it but that's even more dangerous than the ignorant ones. I don't use extensions for firefox, chromes that I don't know. I've got only less of them that I think that I really use at most times.

Avoid randomly installing extensions that we don't need.

We can avoid these extensions but those users that are not aware of it and probably directed to download them that becomes a requirement for such task, they need to verify and be careful with.

[Zaguru12]

This is a very disturbing news because people can easily fall for this type of security concern. Firefox is not one of the browser I trust given their history of being porous and a soft target for criminals, there are still a good number of people that use the browser. I think the basic safety measures of using only official website for downloads should be able to fix this and only lazy or people who ignore that will be victim of this threat. Scammers are really working overtime to achieve their aim which is to steal, we should be careful out there.

This isn’t about Firefox alone almost all extensions even on chrome have clone versions, just like OP said it is possible because the codes are open source and can be used by scammers to develop the clone type. I remember Metamask repeatedly releasing reports that there are many of their clone extensions, first to always get this extension from the right source and verify from the official website, this scammers are not sophisticated that they manipulate even reviews on App Store or play stores.

Best practice as crypto investor is to always have a cold wallet and use burner wallets on all online wallets, having little amount will definitely not hit hard when been affected, many coins should always be on cold wallet that’s one way to avoid this

[coupable]

This warning is very important for both new and old users, and I hope as many users as possible see it since the news is new and I don't think many have noticed it.

I've never read about Mozilla users losing their assets for any reason. However, I've recently started noticing Firefox notifications in Russian on my mobile browser. Since I don't speak Russian well, I assumed they were advertising notifications and not recommendations to install a browser add-on or use a specific feature. This is very dangerous and could result in the loss of huge amounts of cryptocurrency, given the large number of Mozilla Firefox users across various devices. I encourage everyone to share this warning everywhere.

[BitGoba]

Over 40 fake Firefox extensions impersonating popular crypto wallets have been noticed since April of this year. Just as the usual ones, they are copying the open source codes of the original apps which makes it easy for the bad actors, they will include the malicious code after.

Another thing is that some of the extensions have good reviews already, unlike before that they may not have any review or have just little reviews. It was reported that one of the fake ads have hundredsof fake five-star reviews.

It is suspected that the bad actors are Russians because Russian-language comments are in the code and metadata found in a PDF file retrieved from a malware command-and-control server involved in the incident

They are impersonating wallet tools such as Coinbase, MetaMask, Trust Wallet, Phantom, Exodus, OKX, MyMonero, Bitget and others. Once installed, the malicious extensions are designed to steal users’ wallet credentials.

https://cointelegraph.com/news/over-40-crypto-stealing-firefox-extensions-discovered

If hackers now have malicious extensions with hundreds of good reviews, we really need to be more careful. My device for bitcoin, other crypto, banks other money related apps is not used for something like apps and extensions download. Also get cold wallet for high amount of coins instead.

It is also good to know the official sites of the apps and extensions and download there directly.

I don’t use MetaMask or any of the others you mentioned because they’re shitcoin wallets. I only use Bitcoin and Lightning wallets. I have only the GetAlby extension, which I use for Lightning Auth login and for sending and receiving sats tips on Nostr.

[Nwada001]

With how advanced these scammers are getting, it's getting scarier every day to even share the same device you use for your wallet transactions on gadgets you use to visit the internet every day because some of these extensions being clones of a popular one can easily be mistaken and installed without knowing the danger that lies ahead. Even if the user is making use of a cold wallet, it's still not entirely safe to connect it to an infected device.

[satscraper]

As for me, I don't use this browser; I use Google Chrome.

It's a toss-up which is worse as you may be targeted by hackers if your Chrome is not patched yet to withstand their latest exploits that probe browser's Chrome's JavaScript engine.

That said, if you're dealing with crypto, it's far safer to rely on reputable hardware wallets rather than on extensions in browser of any kind.

[Die_empty]

Having hundreds of positive reviews shows that we shouldn't rely on these comments to determine a legitimate product. Hence, we would have to verify any app we see online because scammers are seeking means to steal from people.

I am not good at coding, but I think criminals will seek means to cover up their location or identity. So some of the comments or codes in the Russian language might be a ploy to cover up their tracks ( they might not be Russians since translators are easily accessible). The bull run comes with lots of criminal activities,  hence there is a need to be cautious. OP you did well in sharing this information.

[Woodie]

Cyber crimes are becoming a menace in today's digital world, and with official plug-in stores being littered with knockoffs such that one cant tell which is the legit and which isn't especially for those jumping on the crypto boat for the first time, its really turning out to be a challenge..I think a more proactive approach is needed to keep these places safe from phishing or hacks.. Wisdom of the crowd  will always help just hope it doesn't come at a cost of someone losing their coins before registering a problem.

[Patikno]

Over 40 fake Firefox extensions impersonating popular crypto wallets have been noticed since April of this year. Just as the usual ones, they are copying the open source codes of the original apps which makes it easy for the bad actors, they will include the malicious code after.

This is really dangerous, and needs to be known by many people, especially for one of the wallet users, like me who is also one of the users of a wallet (but the one I use is official).
     
Luckily, I installed the official version of the bitget wallet and it was in chrome, and I thought that it would be dangerous if I was someone who actively used the firefox browser application. And the way I usually do it before installing is through official site references, and you should try this for security reasons.

I also found that the bitget party (which I use) also announced this important news, and I agree with the important advice they said, namely that we should be extra careful when installing any add-on in Firefox, checking official sources and the authenticity of the tool , and this applies to any type of wallet (I just happen to be sharing what I experienced, and don't mean to shilling).

What I found was a similar wallet extension in Firefox, and it really exists, even though the official side does not state that they provide extensions in Firefox and I only saw it on Chrome. and even there were two of them (potentially dangerous), we can look it below:

     
     

[Alphakilo]

There are many more like these that are still yet to be discovered. While that is ongoing, people must be aware, that is to stay safe , always visit the official website of any wallet app that you want to download from the internet.

While Firefox browser operators may not have been aware of these issues, however it is still their responsibility to do their security checks to ensure that they are not enabling crypto thefts in one way or another due to their negligence.

[DubemIfedigbo001]

Anything that has to do with browsers is marked unsafe by me, from saving passwords to installing extensions or even using it in a device containing my wallets.

I practice separation of concerns a lot. My main wallet bearing device doesn't make use of a browser, more like anytime I go online with the device, I'm either doing some banking activities or wallet transactions. A lot of social engineering violations comes from the browsers and app stores. I'm more comfortable downloading from official sites rather than corresponding app stores.

[promise444c5]

Another thing is that some of the extensions have good reviews already, unlike before that they may not have any review or have just little reviews. It was reported that one of the fake ads have hundredsof fake five-star reviews.

It’s so so easy these days to getaway with fake reviews, likes, comments and so on , just too easy and that’s why I don’t just trust them . when it comes to reviews on an app, what if  do go for is actually bad reviews, yeah the bad reviews are most likely from a real person stating issues with such app . Also, if an app doesn’t have any bad reviews  then it’s a red flag for me (in most cases).

[sokani]

Another thing is that some of the extensions have good reviews already, unlike before that they may not have any review or have just little reviews. It was reported that one of the fake ads have hundredsof fake five-star reviews.

Thanks for sharing. Having positive reviews and high ratings are not enough because they could be faked. The Mozilla team are doing their best to remove these fake extensions the moment they're detected, but scammers keep creating and dumping them. One way to avoid downloading a fake extension is to visit the official website of the extension you want to download and follow the backlink to Firefox add-ons.

[BIT-BENDER]

With how advanced these scammers are getting, it's getting scarier every day to even share the same device you use for your wallet transactions on gadgets you use to visit the internet every day because some of these extensions being clones of a popular one can easily be mistaken and installed without knowing the danger that lies ahead. Even if the user is making use of a cold wallet, it's still not entirely safe to connect it to an infected device.

I always say this, you may believe you have everything secure but you may be stunned with a very sophisticated scam attack that may even break every protection barrier you can think of.
What I do is that I have a device that I only use for my Crypto-currency wallet and it is offline. Nothing they say is hundred percent safe not even the white house but if you want to have longevity in crypto-currency then you must do everything to protect yourself.

[DYING_S0UL]

These hackers/scammers are evolving/changing their scamming strategy day by day, so we must keep our guard high all the time. These hacks are becoming so rampant and aggressive, that it is nearly impossible to stay safe from these attacks and not being a victim once in our life's. They are hitting us from the most unexpected ways, draining our wallets, without us realizing what just happened. Which is exactly why I have always tried to limit my third party software installations, even better I rarely test out new things in my workspace. I only have a few software/extension installed in my system, which I am totally sure of and never introducing anything curiosity to my system.

Thanks op for sharing these articles and spreading awareness. I'm sure many of us, including me, are staying well updated regarding these methods because of your posts.