Firefox Add-ons Store targeted by malicious crypto-stealing extensions

Three malicious Firefox extensions designed to impersonate popular cryptocurrency wallets were identified on the Firefox Add-ons store. The fraudulent modules mimicked Phantom, Jupiter, and Bitget by using identical names, icons, and marketing text to deceive users.

According to findings by Socket.dev, these extensions were engineered to steal recovery phrases and private keys, which would allow attackers to drain cryptocurrency wallets completely. The malicious software utilized various deceptive tactics, such as using Unicode characters to visually mimic the Phantom name and hiding server addresses within scripts.

The extensions were found to be communicating with a command and control domain, bonto.io. All three fraudulent modules have since been removed from the Firefox Add-ons store.