Malicious Firefox Extensions Impersonated Phantom, Jupiter and Bitget Wallets
Summary
Socket researchers identified three malicious Firefox extensions impersonating Phantom, Jupiter and Bitget. The add-ons stole recovery phrases and private keys; all three listings were removed after the analysis.
Key points
- Socket researchers identified fake Phantom, Jupiter and Bitget Firefox extensions; their add-on IDs were 3092199, 3092666 and 3092059, respectively.
- The extensions searched for 12-, 15-, 18- and 24-word recovery phrases and Ethereum and Solana private keys, and could read input fields, pasted text and phrases displayed on screen.
- The Phantom variant logged captured secrets, sent them to a Telegram bot and automatically moved funds to hardcoded payout addresses.
- The fake Phantom listing requested access to data on all websites and had no privacy policy.
- All three listings were live during Socket’s analysis and have since been removed.
- Users who find one should remove it; anyone who entered a phrase or key should treat the old wallet as compromised, create a new wallet on a clean device and move their assets. Install wallets only through official vendor links.
Article Details
- Event Type
- Malicious Firefox extensions impersonated cryptocurrency wallets and stole recovery phrases and private keys.
- Impact
- The extensions could expose users' wallets to full attacker control. The Phantom variant logged captured secrets, sent them to a Telegram bot, and automatically moved funds to hardcoded payout addresses. Socket reported that all three listings had been removed after its analysis.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bitget[.]bonto[.]io | Listed as a subdomain IOC associated with the malicious wallet-extension campaign. |
| DOMAIN | bonto[.]io | Listed as a subdomain IOC associated with the malicious wallet-extension campaign. |
| DOMAIN | coinbase[.]bonto[.]io | Listed as a subdomain IOC associated with the malicious wallet-extension campaign. |
| DOMAIN | exodus[.]bonto[.]io | Listed as a subdomain IOC associated with the malicious wallet-extension campaign. |
| DOMAIN | jupiter[.]bonto[.]io | Listed as a subdomain IOC associated with the malicious wallet-extension campaign. |
| DOMAIN | phantom[.]bonto[.]io | Listed as a subdomain IOC associated with the malicious wallet-extension campaign. |
| IPV4 | 104[.]21[.]34[.]69 | IP address listed in the article's IOC section for the malicious wallet-extension campaign. |
| IPV4 | 172[.]67[.]155[.]198 | IP address listed in the article's IOC section for the malicious wallet-extension campaign. |
Products
BitgetSocket’s threat researchers found three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget crypto wallets.JupiterSocket’s threat researchers found three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget crypto wallets.Mozilla FirefoxSocket’s threat researchers found three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget crypto wallets.PhantomSocket’s threat researchers found three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget crypto wallets.