[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiDx2-2oXcCjzwKhAUNgvsk-h_emISxyJrjxPAF0vGPs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"027801eb-542e-4b31-814d-c81ccad84b2b","fake-crypto-wallet-extensions-on-firefox-store-steal-private-keys","f2154dce-19b2-4763-8ec0-5b0e019d1cce","Fake Crypto Wallet Extensions on Firefox Store Steal Private Keys","Attackers published malicious Firefox extensions that convincingly impersonated legitimate crypto wallet brands—Phantom, Jupiter, and Bitget—to trick users into installing them and surrendering their recovery phrases and private keys. The incident highlights a critical supply chain trust problem: official browser extension stores are not immune to malicious submissions, especially when bad actors use post-approval loader techniques to alter behavior after passing review. Users who relied solely on the Firefox Add-ons store's implied legitimacy had no additional safeguards to catch the deception. This matters enormously in the crypto space because compromised private keys and recovery phrases result in irreversible financial loss with no recourse.","**Immediate actions:**\n- Verify any crypto wallet extension by cross-referencing the exact publisher name and extension ID against the official wallet project's website before installing.\n- Remove any recently installed wallet extensions and rotate recovery phrases and private keys if there is any doubt about the extension's authenticity.\n\n**Long-term improvements:**\n- Adopt an allowlist policy for browser extensions within organizations, permitting only vetted and approved extensions to be installed on managed devices.\n- Implement endpoint security tools capable of detecting suspicious network traffic to unknown command-and-control domains such as bonto[.]io subdomains.\n- Educate users regularly on software supply chain risks, including the threat of trojanized browser extensions that mimic trusted brands.\n\n**Detection measures:**\n- Monitor outbound DNS and HTTP traffic for connections to newly registered or unknown domains that could indicate data exfiltration from browser extensions.\n- Use browser security policies (e.g., enterprise extension management) to log and alert on any newly installed or updated extensions across managed endpoints.",[12,13,14,15,16,17,18],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":23,"CIS Control 14: Security Awareness and Skills Training":24,"CIS Control 2: Inventory and Control of Software Assets":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 mandates supply chain security measures including assessment of the security of software components, which would require organizations to vet browser extensions before permitting their use in operational environments.","Disguising malicious extensions as trusted wallet brands is a social-engineering lure analogous to phishing, where impersonation of a trusted entity tricks victims into surrendering credentials or installing malware.","Store-level vetting processes failed to detect the loader-based evasion technique, pointing to the need for continuous integrity monitoring of approved software, not just one-time review at submission.","Organizations must ensure personnel have the competence to recognize supply chain software risks, including the danger of counterfeit browser extensions targeting high-value assets like crypto wallets.","Users trained to verify software authenticity through official vendor channels rather than trusting store listings alone would be far less likely to install impersonating extensions.","Maintaining an approved inventory of authorized browser extensions would have prevented unapproved, malicious extensions from being installed on managed systems.","Protecting cryptographic keys and recovery phrases requires strict access controls and user practices that prevent unauthorized exfiltration, which these malicious extensions bypassed entirely through user deception.","published","2026-10-28T14:22:05.530946+00:00","2026-10-28T14:22:05.514+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Fmalicious-firefox-extensions-3\u002F","malicious-firefox-extensions-impersonate-phantom-jupiter-and-bitget-to-steal-cry-62f117","Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Crypto Wallet Keys",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":54,"name":55,"problem":56},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":58,"name":59,"problem":60},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]