Malicious Firefox extensions targeting cryptocurrency

Cybersecurity researchers have identified ongoing campaigns involving malicious Firefox extensions designed to steal cryptocurrency credentials.

In early October 2026, Mozilla removed 16 extensions that targeted Rabby Wallet and OKX Wallet users. These extensions, some of which used deceptive misspellings like ‘Raabby WaIIet’, were designed to intercept mnemonic phrases and private keys during the wallet import process. Researchers noted that this activity appeared to be a continuation of a campaign from August 2026, utilizing existing network infrastructure to exfiltrate data to attacker-controlled domains.

By late October 2026, a new wave of fraudulent modules was identified on the Firefox Add-ons store. These extensions impersonated Phantom, Jupiter, and Bitget by using identical names, icons, and marketing text. The malware used Unicode characters to mimic legitimate names and communicated with a command and control domain, bonto.io. All identified fraudulent modules have been removed from the store.