Dozens of Fake Firefox Wallet Extensions Linked to Crypto Stealing Malware

[suzanne5223]

According to the Socket security firm, a batch of malicious encrypted wallet extensions targeted Firefox browser users.
Currently, 77 extension identities have been linked, with 40 confirmed to be malicious, and this is expected to have started from at least March 2026. These extensions primarily impersonate well-known Web3 wallets such as OKX, Rabby Wallet, and TronLink, using highly realistic wallet interfaces to trick users into importing their existing wallets and stealing their mnemonic phrases or private keys.

All these extensions directly require users to enter their mnemonic phrases, while 13 are tampered versions of Rabby that send data to external servers when users save their wallet account information.
Five other extensions collect saved credentials and clipboard content. Socket also discovered that at least nine malicious extensions previously operated as sports score apps (football, basketball, NBA, etc. This is goes for all we gamblers), accumulating users and reviews before updating and replacing them with wallet-stealing code. In addition, 37 extensions disguised themselves as password generators, VPNs, currency converters, etc., actually running sports score programs. Socket warns that if users have entered mnemonic phrases or private keys in these extensions, their wallet credentials have been permanently compromised.
Uninstalling the extension alone cannot undo the leaked mnemonic phrases or private keys; users should immediately transfer their assets to a new secure created wallet.

[un_rank]

You should treat all extentions as potentially malicious including the ones recommended by the browser. Only use them if you absolutely have to and never on a device where you hold your bitcoins. You should never also type your seedphrase or private keys on them or anywhere else.

Uninstalling the extension alone cannot undo the leaked mnemonic phrases or private keys; users should immediately transfer their assets to a new secure created wallet.

If you have sent your seedphrase to a scammer you will not have the opportunity to sweep your wallet to a new one.

- Jay -

[Hazink]

For some reasons, I don't like using anything that has to do with wallet extensions. Hot wallets are at risk on their own, but I consider it more risky for them to be attached to my browser on a PC. I usually use to access the internet almost every time, adding to the possibility of installing a fake wallet.

The names of the apps and software were not listed in the article for one to check if he or she has any of them installed. 

If there is anywhere I could have easily got affected will be when I was so obsessed with designing my phone with fancy keyboards, launchers and whatever that will make my phone screen appear fashionable but as we speak, I barely install apps I don’t need on my gadgets.

Uninstalling the extension alone cannot undo the leaked mnemonic phrases or private keys; users should immediately transfer their assets to a new secure created wallet.

If you have sent your seedphrase to a scammer you will not have the opportunity to sweep your wallet to a new one.

- Jay -

Those hackers behave like they have some bots always active to empty wallet balance immediately they gain access to the wallet key, they are more active that they want to give victim the chance to recover anything.

[tech30338]

if you really can't avoid using browser wallet or extensions , be sure to always check where you connect your wallet, its always the culprit when an extension or a site that you connect that wallet gets compromise surely sometimes all the funds in that wallet got sweep in an instant, experience this with my friend good thing we have send the funds to this another wallet without the hacker getting the funds but its tricky and need timing, stressful so be very careful on what you are doing.

[348Judah]

For those who like using a browser wallet or some of these social Media platform wallets that come along with the app, we should be warned and guided at the same time, as there could be some loopholes that can lead to a possible hack on our device, we have to be conversant with how we get information upon threat like this, show me prevent us from being a scam victim if we are being informed earlier than later.

[sokani]

For some reasons, I don't like using anything that has to do with wallet extensions. Hot wallets are at risk on their own, but I consider it more risky for them to be attached to my browser on a PC. I usually use to access the internet almost every time, adding to the possibility of installing a fake wallet.

It is not just crypto wallets that are being targeted. Scammers have advanced their tactics by also targeting frequently used non-crypto apps, like the ones OP mentioned, and I'm not surprised at all because they are quite clever. Whenever the malicious extensions of these apps are downloaded on a device, the malware will work its magic by stealing the user's sensitive information, such as the seed phrase, credit card details, saved browser logins, etc, and send it to the scammer.

[Mia Chloe]

~snip

Sometimes extensions are not even necessary people just load their browsers with so many extensions and many of them don't even make use of them. The first important impression is if the extension is not solely important to you don't bother trying to have it it's not worth the hassle.

Sometimes open source doesn't matter to the average Joe because most of them cannot even tell if it's a malware or if there is a potential backdoor hidden in the code. I'm still always surprised why I would need a wallet extension.

[Ndabagi01]

I don’t even know of this kind of wallet extension, how they work and operate even though I have heard of them in this forum before still relating to wallet extension in Firefox browser. An external source of wallet supported by a browser is not even sending a positive message to use. I will just pass and not even bother to download the extension. Scammers have been actively using new methods to get to their victims, they’re getting advanced just the way technology is also advancing. Getting acquainted and knowing how these guys work is very important to avoid getting scam off your funds in a jiffy by just a mistake you overlooked.

[Charles-Tim]

if you really can't avoid using browser wallet or extensions , be sure to always check where you connect your wallet, its always the culprit when an extension or a site that you connect that wallet gets compromise surely sometimes all the funds in that wallet got sweep in an instant, experience this with my friend good thing we have send the funds to this another wallet without the hacker getting the funds but its tricky and need timing, stressful so be very careful on what you are doing.

For those who like using a browser wallet or some of these social Media platform wallets that come along with the app, we should be warned and guided at the same time, as there could be some loopholes that can lead to a possible hack on our device, we have to be conversant with how we get information upon threat like this, show me prevent us from being a scam victim if we are being informed earlier than later.

I do not like browser extension wallets, but I use browser extensions. Know that any browser extension belonging to hackers can be used to get malware into someone's device. This is the reason people should know how to avoid fake extensions. To avoid them is simple, but many people do not make research to know. I reduce the number of extensions that I am using and at least thousands of people are using the extensions that I am using.

[Amphenomenon]

It should be known that linking key wallets to extensions online is a terrible thing, I remember when malware was common among Vs codes extensions and people suffered from it.

That was an eye opener, while there are ignorant individuals still, I hope a sense of cautiousness comes upon many for them to be mindful,  it doesn't matter if it has large amount of users it can still continue malicious code. In the Internet we all needs to be careful/mindful.

[PrivacyG]

OP, I believe your Topic should be rather posted as a reply in the Mega Topic made by Mitchell (https://bitcointalk.org/index.php?topic=5590142.0).  I quoted you there just in case this Topic gets deleted.

[Mitchell]

Yep. Should've been posted in the [General] Crypto scams, attacks and malware-topic. This makes it easier for newbies to find and keeps the section clean (since we don't have 20 different warning topics).

Locking this topic. Feel free to post it there yourself (I'll remove PrivacyG post if you do).