16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials
Summary
Socket researchers found 16 Firefox extensions that steal wallet recovery phrases and private keys, sending them to attacker-controlled Cloudflare Workers. Mozilla unpublished the extensions by October 5; affected users should move assets to a new wallet.
Key points
- Four extensions impersonate Rabby Wallet and intercept recovery phrases or private keys during wallet import; 12 clones target OKX Wallet users with recovery-phrase prompts.
- The extensions transmit secrets to attacker-controlled Cloudflare Workers. Rabby clones use GET query parameters; OKX variants send POST data or use fallback transports.
- One of the 16 extensions is broken as packaged: Firefox does not load its background script, and the frontend message does not match the handler. Its code still contains secret-collection and exfiltration logic.
- Shared code, campaign markers, and infrastructure link the extensions to two related families; Socket assesses the activity as a continuation of a campaign it identified in August 2026.
- Mozilla had unpublished the extensions as of October 5. Users who entered a real seed phrase or private key should create a new wallet from a clean environment and move assets; changing the extension password is insufficient.
- Defenders can search for the campaign marker, extension IDs, file hashes, and Worker hosts. Network detections should redact the secret-bearing field.
Article Details
- Attack Vectors
- Malicious Firefox extensions impersonated Rabby Wallet and OKX Wallet, prompting users to enter recovery phrases or private keys.
- The extensions intercepted wallet import operations and exfiltrated raw recovery material to Cloudflare Workers. Rabby clones used GET query parameters; active OKX variants used HTTPS POST JSON.
- The broken [email protected] variant contained secret-collection and exfiltration code but did not operate through its normal packaged flow because its manifest did not load the background script and its frontend and background message types did not match.
- Defensive Notes
- Mozilla had unpublished the extensions as of October 5, 2026.
- Remove the listed extension IDs, review Firefox profiles and synchronized extension state, and search inventories and network telemetry for the listed hashes, campaign marker, and Worker endpoints.
- Users who entered a real recovery phrase or private key should treat the wallet as compromised, create a new wallet from a clean environment, and move assets. Changing the extension password does not invalidate exposed wallet credentials.
- Avoid copying secret-bearing request field w into security notes or alerts, and preserve the original XPI and browser profile without running the extension on an analyst host.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 0aed5f24ce625ee6b9422083302766f74b0b9a57e1b18213328b950cc7057e35 | Hash of the XPI for the broken malicious extension [email protected]. |
| SHA256 | 225f5d6c5d70a7e7f3abf62ea0dda1cf8bf8e70565f7db748b0d8fa602da939b | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | 2f9270269e631bc4fd634d741afcfc3df8f54e43e40b16f38660fe8ce6c26f51 | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | 4512389444a767f12211beeb5f2ad165aca4a558e88e8f111affb30b77ed6a5a | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | 458e7255438f15aaede02fd7f8fcfdf762aa6e08608b9546fe8aa8aa399c76b7 | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | 635b31b4a19b5673fcbe0fedeb3f7ed2c27fddb739685f19ca5f3d1f1d7f0083 | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | 6b53369fb868efb92b60af40fbd5906fa3d3d8785a7878b4af6e4efd333a4de8 | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | 71ec70479ab78efb1e1f9507f8ff7348d5711c837cc50a0120f3a188c340f3f4 | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | 7d9d7e80ed52350616be0215a7ded10aaeb9aaa64e34ff8af7f9177c8c855799 | Hash of the Rabby-clone background.js file containing credential-exfiltration logic. |
| SHA256 | 8906dd85b0991fac14e5973b3f3f61d93ef1101504cb5867a004c762ee184ef7 | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | 9fea0ee3c81047f5e50eeb3a2ab2a7cd70357f3e49944b7079ab3e90c9ea0e8b | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | b02ae1d5a0d2a5b28f8baa2afcdc7d7090fab051536303cba3ba1f17860da980 | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | bb8f60b3f77d96adc93bf0515b34df7c5f1f560a9f6d0c353b7d849609e3557d | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | be246ca5cb1372394e0443df45454f88ca39eb4a8dcfc4a99cb8865100fb4897 | Hash of the broken variant background.js containing secret-collection and exfiltration code. |
| SHA256 | c550f0860012e0dfab14ed65a9425961e22025e0ab23fd9d69d294a8aa34db2f | Hash of the OKX Clone Web3 Portal background.js file. |
| SHA256 | d9432e41e0401715bce4ce11f4a7104d94fab1ec89be553ba57a2097e418c1a1 | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | da447fe02e4577da97144a4d92b395078954fde1ff196746413837e1e4a20bcd | Hash of the OKX clone core background.js file. |
| SHA256 | e5c9a29d5ba0f53a49d8b333bfab17bf9878f94e8c3f325f5afacad44bb26fb5 | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | e96c75cd0c9b35000b4a3ec12d5dd23ca157e94aee7271a0fe8d8d7c9f2e9096 | Hash of the XPI for [email protected], identified as a malicious extension. |
| SHA256 | eb134bbf73046800c8177383754cf754b8776ec30cf5cc8a13655d259e49a4bf | Hash of the shared compact frontend used by the wallet-credential-stealing extensions. |
| SHA256 | faf174414ddc7099360c4ae4d16497b9846cfae71ffad5bbab820bba657f94d3 | Hash of the XPI for [email protected], identified as a malicious extension. |
| URL | hxxps[:]//flat-wildflower-f954[.]fondationanimalaidrelief[.]workers[.]dev/ | Attacker-used Worker endpoint associated with an OKX clone variant. |
| URL | hxxps[:]//green-firefly-ab28[.]icy-star-f45c[.]workers[.]dev/ | Attacker-used Worker endpoint receiving recovery phrases from OKX clones. |
| URL | hxxps[:]//silent-wind-get[.]icy-star-f45c[.]workers[.]dev/ | Attacker-used Worker endpoint receiving wallet secrets from Rabby clones. |
| URL | hxxps[:]//small-boat-969c[.]icy-star-f45c[.]workers[.]dev/ | Attacker-used Worker endpoint receiving recovery phrases from OKX clones. |
Products
Mozilla FirefoxSocket Threat Research identified a coordinated campaign of 16 Firefox extensions targeting cryptocurrency wallet users. The extensions masquerade as wallet portals, desktop utilities, and browser tools, but their codeOKX WalletTwelve smaller extensions are targeted clones of OKX Wallet, the popular DeFi wallet app with over 1,000,000 users on then Chrome Web Store. Eleven register a background script that receives a 12- or 24-word phrase andRabby WalletFour large extensions are clones of Rabby Wallet, a popular Ethereum wallet app with 900,000 users on the Chrome Web Store and 500,000 downloads on Google Play. They impersonate Rabby as Raabby WaIIet, hook mnemonic and