Malicious Firefox Extensions Impersonate Crypto Wallets to Steal Recovery Phrases and Private Keys

Oct 27, 2026 · Original article ↗

Summary

Socket researchers analyzed three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget that steal wallet recovery phrases and private keys; the Phantom variant also fetches and executes a remote payload. The listings were removed by publication.

Key points

Socket found stealers bundled in all three signed extensions; the Phantom impersonator also fetched a remote payload and injected it into pages, while the Jupiter and Bitget stealers were bundled in their packages.
The stealers capture recovery phrases and private keys through page inputs, paste and focusout events, and page-text scanning; the Phantom variant also hooks the injected Solana provider.
Captured secrets are sent to brand-named subdomains under bonto[.]io. Socket also found provisioned Coinbase Wallet and Exodus subdomains, but did not locate corresponding listings.
The Phantom package included a backend configured to log captured secrets, forward them to a Telegram bot and sweep funds to hardcoded cryptocurrency addresses.
All three listings were live during Socket’s analysis and had been removed by publication. The article says reported user losses in Phantom reviews were self-reported and unverified.
Socket recommends installing wallet extensions through official vendor links, pinning approved extension IDs, and blocking bonto[.]io and its subdomains.

Article Details

Attack Vectors: Malicious Firefox extensions impersonated Phantom, Jupiter, and Bitget using Unicode homoglyphs, copied branding, and misleading listings.
The Phantom extension fetched a configuration and base64-encoded second-stage payload from phantom[.]bonto[.]io/config, decoded it, and executed it in the main world of opened pages.
The extensions captured recovery phrases and private keys from page inputs, paste and focusout events, page text, and wallet-related data, then sent the stolen information to brand-named subdomains of bonto[.]io.
The bundled Phantom backend forwarded captured secrets to a Telegram bot and swept funds to hardcoded payout addresses.
The Phantom listing showed rating manipulation: its review count and average rating rose sharply over roughly two days.
Defensive Notes: Install wallet extensions only through links from the vendor’s official website, not through store search results; never enter a recovery phrase or private key outside the legitimate wallet flow.
If a recovery phrase or private key was entered into one of these extensions, treat the wallet as compromised and move funds to a new wallet created on a clean device.
Pin approved extension IDs and review extensions requesting access to all websites together with tabs or scripting permissions.
Monitor for extensions that fetch configuration or code at runtime and then use eval or scripting.executeScript; hunt for signed bundles that inject into the main world.
Block bonto[.]io and its subdomains, and alert on DNS lookups for brand-named subdomains beneath that apex.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`bitget[.]bonto[.]io`	Attacker-controlled exfiltration host receiving secrets from the Bitget impersonator.
DOMAIN	`bonto[.]io`	Attacker-controlled C2 apex used for exfiltration and second-stage delivery through its subdomains.
DOMAIN	`coinbase[.]bonto[.]io`	Provisioned campaign subdomain with a response signature matching confirmed exfiltration hosts; the article says this indicates targeting of the Coinbase Wallet brand.
DOMAIN	`exodus[.]bonto[.]io`	Provisioned campaign subdomain with a response signature matching confirmed exfiltration hosts; the article says this indicates targeting of the Exodus brand.
DOMAIN	`jupiter[.]bonto[.]io`	Attacker-controlled exfiltration host receiving secrets from the Jupiter impersonator.
DOMAIN	`phantom[.]bonto[.]io`	Attacker-controlled host serving the Phantom extension’s runtime configuration and second-stage payload, and receiving stolen data.
SHA256	`311c49974f28d33947b8b74d78b48f51855eacac182d519a4fe1daa6af7f30e9`	SHA-256 hash of the malicious Phantom impersonator XPI package.
SHA256	`999bccd41188a238a50d05b5aca8e35af45d107f32d7443389313816f0cb226a`	SHA-256 hash of the Phantom second-stage payload served by phantom[.]bonto[.]io/config.
SHA256	`e688bff5df32f209b4ebb882985e3ad19ddee68666405c39ff523307068a8611`	SHA-256 hash of the malicious Bitget impersonator XPI package.
SHA256	`fd7b138f4fba003db332a4eee833e84491bf7ffec5a3d91f7451d7b95aabcf6a`	SHA-256 hash of the malicious Jupiter impersonator XPI package.
URL	`hxxps[:]//bitget[.]bonto[.]io/`	Bitget impersonator exfiltration endpoint for captured wallet secrets.
URL	`hxxps[:]//jupiter[.]bonto[.]io/`	Jupiter impersonator exfiltration endpoint for captured wallet secrets.
URL	`hxxps[:]//phantom[.]bonto[.]io/`	Phantom campaign C2 endpoint identified as a second-stage delivery and exfiltration point.
URL	`hxxps[:]//phantom[.]bonto[.]io/config`	Malicious configuration and second-stage payload URL used by the Phantom extension loader.