Malicious Firefox add-ons steal secrets from crypto wallets

Three malicious Firefox extensions were found impersonating popular crypto wallets Phantom, Jupiter and Bitget. Socket’s threat researchers reported that the rogue add-ons, still live on Firefox Add-ons during their analysis, could capture recovery phrases and private keys after installation, enabling the attacker to take full control of affected wallets.

The Phantom impersonator’s backend reportedly logged captured secrets, sending them to a Telegram bot and automatically moving funds to hardcoded payout addresses across a wide range of networks, including Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana and Bitcoin.

The extensions target recovery phrases of 12, 15, 18 and 24 words, and can read input fields, detect pasted text, and scan screens displaying recovery phrases. The Phantom variant specifically could read a phrase both when typed during import and when revealed on-screen. The report lists the affected extension names by their Firefox add-on IDs: Phantom impersonator (add-on ID 3092199), Jupiter impersonator (add-on ID 3092666), and Bitget impersonator (add-on ID 3092059).

Subdomains and related infrastructure identified by Malwarebytes include bonto[.]io and several phantom/jupiter/bitget subdomains, plus associated IPs 104.21.34[.]69 and 172.67.155[.]198. In response, the three fraudulent listings have been removed from Firefox Add-ons; victims are urged to remove any suspicious extensions, create new wallets on a clean device if recovery data was exposed, install wallet software only from official vendor sites, and rely on up-to-date anti-malware to block malicious sites.