# Malicious Firefox extensions targeting cryptocurrency > Developing situation record from CLSTR: https://clstr.news/situations/malicious-firefox-extensions-targeting-cryptocurrency > Updated: 2026-10-29T21:55:37.000Z. Sources: 2. Developments: 2. Cybersecurity researchers have identified ongoing campaigns involving malicious Firefox extensions designed to steal cryptocurrency credentials. In early October 2026, Mozilla removed 16 extensions that targeted Rabby Wallet and OKX Wallet users. These extensions, some of which used deceptive misspellings like ‘Raabby WaIIet’, were designed to intercept mnemonic phrases and private keys during the wallet import process. Researchers noted that this activity appeared to be a continuation of a campaign from August 2026, utilizing existing network infrastructure to exfiltrate data to attacker-controlled domains. By late October 2026, a new wave of fraudulent modules was identified on the Firefox Add-ons store. These extensions impersonated Phantom, Jupiter, and Bitget by using identical names, icons, and marketing text. The malware used Unicode characters to mimic legitimate names and communicated with a command and control domain, bonto.io. All identified fraudulent modules have been removed from the store. ## Timeline ### 2026-10-29: Firefox Add-ons Store targeted by malicious crypto-stealing extensions Three malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets were removed after being caught stealing cryptocurrency recovery phrases and private keys. 2 sources. https://clstr.news/cluster/firefox-add-ons-store-targeted-by-malicious-crypto-stealing-extensions ### 2026-10-08: Mozilla removes 16 malicious Firefox extensions targeting crypto wallets Mozilla removed 16 malicious Firefox extensions that impersonated Rabby and OKX wallets to steal cryptocurrency recovery phrases and private keys via Cloudflare Workers. 2 sources. https://clstr.news/cluster/mozilla-removes-16-malicious-firefox-extensions-targeting-crypto-wallets --- Cite as: Malicious Firefox extensions targeting cryptocurrency. CLSTR, https://clstr.news/situations/malicious-firefox-extensions-targeting-cryptocurrency