Fake Crypto Wallet Extensions on Firefox Store Steal Private Keys
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers published malicious Firefox extensions that convincingly impersonated legitimate crypto wallet brands—Phantom, Jupiter, and Bitget—to trick users into installing them and surrendering their recovery phrases and private keys. The incident highlights a critical supply chain trust problem: official browser extension stores are not immune to malicious submissions, especially when bad actors use post-approval loader techniques to alter behavior after passing review. Users who relied solely on the Firefox Add-ons store's implied legitimacy had no additional safeguards to catch the deception. This matters enormously in the crypto space because compromised private keys and recovery phrases result in irreversible financial loss with no recourse.
Tactical Insight
Immediate actions
- Verify any crypto wallet extension by cross-referencing the exact publisher name and extension ID against the official wallet project's website before installing.
- Remove any recently installed wallet extensions and rotate recovery phrases and private keys if there is any doubt about the extension's authenticity.
Long-term improvements
- Adopt an allowlist policy for browser extensions within organizations, permitting only vetted and approved extensions to be installed on managed devices.
- Implement endpoint security tools capable of detecting suspicious network traffic to unknown command-and-control domains such as bonto[.]io subdomains.
- Educate users regularly on software supply chain risks, including the threat of trojanized browser extensions that mimic trusted brands.
Detection measures
- Monitor outbound DNS and HTTP traffic for connections to newly registered or unknown domains that could indicate data exfiltration from browser extensions.
- Use browser security policies (e.g., enterprise extension management) to log and alert on any newly installed or updated extensions across managed endpoints.