Mozilla removes 16 malicious Firefox extensions targeting crypto wallets

Mozilla has removed 16 malicious Firefox extensions designed to steal cryptocurrency recovery phrases and private keys. Cybersecurity researchers at Socket identified the extensions masquerading as wallet portals, desktop utilities, and browser tools.

The malware specifically targets users of Rabby Wallet and OKX Wallet. Four of the extensions were clones of Rabby Wallet, using subtle misspellings like ‘Raabby WaIIet’ to deceive users. The malicious code intercepts 12 or 24-word mnemonic phrases and 64-character hexadecimal private keys during the wallet import process, allowing the wallet to function normally while secretly exfiltrating credentials to attacker-controlled Cloudflare Workers domains.

Researchers believe this activity is a continuation of a previous campaign documented in August 2026, as the threat actors appear to be reusing the same network infrastructure and credential-handling logic while rotating package names and descriptions. As of October 5, 2026, all identified extensions have been removed from the Firefox catalog.