[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyQg5mHxOzoxVk1HXgt13Pz051vcK6k0h1O5FkWBfhS0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":47},"436800fe-f722-449d-9b9a-4234803da645","40-fake-web3-firefox-extensions-harvest-crypto-wallet-secrets","c0898956-e24c-4df7-92f3-ceb00ccc3db3","40 Fake Web3 Firefox Extensions Harvest Crypto Wallet Secrets","Attackers deployed 40 malicious Firefox extensions impersonating trusted Web3 brands like OKX and Rabby Wallet to trick users into installing credential-stealing software. Once installed, these extensions silently exfiltrated recovery phrases and private keys — the master credentials for cryptocurrency wallets — through legitimate-looking cloud infrastructure (Supabase and Cloudflare Workers) to evade detection. This attack exploits user trust in well-known brand names and the relative openness of browser extension ecosystems. Because cryptocurrency transactions are irreversible, victims have no recourse once wallet secrets are stolen. The campaign's scale — 77 coordinated add-ons sharing code and infrastructure — signals a sophisticated, ongoing threat actor rather than opportunistic fraud.","**Immediate actions:**\n- Audit all currently installed browser extensions and remove any that are unverified, recently installed, or not sourced directly from official project websites.\n- Verify extension authenticity by cross-referencing the official publisher name, extension ID, and download count on the add-on marketplace before installing anything.\n\n**Long-term improvements:**\n- Implement an organizational policy that restricts browser extension installations to an approved allowlist managed by IT or security teams.\n- Store cryptocurrency wallet recovery phrases and private keys exclusively in hardware wallets or air-gapped offline storage, never in browser-accessible environments.\n- Treat any browser extension requesting access to clipboard, storage, or network communications as high-risk and subject it to formal review before approval.\n\n**Detection measures:**\n- Monitor outbound network traffic for unexpected connections to Supabase projects, Cloudflare Workers, or other third-party cloud endpoints that are not part of normal business operations.\n- Subscribe to threat intelligence feeds that track malicious browser extensions and automatically alert users or block known malicious extension IDs at the endpoint level.",[12,13,14,15,16,17,18,19,20],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SC-28: Protection of Information at Rest","NIST Cybersecurity Framework PR.DS-5: Protections Against Data Leaks","GDPR Article 32: Security of Processing (for organizations handling user crypto assets)","ITIL: Change Management — software installation change control","published","2026-08-20T12:22:24.557238+00:00","2026-08-20T12:22:24.275+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002F40-malicious-firefox-extensions-pose-as.html","40-malicious-firefox-extensions-pose-as-web3-products-to-steal-wallet-secrets-84c29f","40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets",[29,35,41],{"id":30,"name":31,"slug":32,"description":33,"color":34},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[]]