16 Malicious Firefox Extensions Impersonated Rabby and OKX Wallets to Steal Recovery Phrases
Summary
Researchers found 16 Firefox extensions impersonating Rabby and OKX wallets to steal recovery phrases and private keys. All were removed by October 5, 2026; affected users should assume exposed wallets are compromised and move their assets.
Key points
- The extensions posed as wallet portals, desktop utilities, and browser tools, intercepting recovery phrases and private keys during wallet import.
- The extensions attempted to send stolen secrets to an attacker-controlled Cloudflare Workers domain; all but one contacted the same identified domain.
- Four extensions impersonated Rabby Wallet, while the rest targeted OKX Wallet.
- Researchers assessed the activity as a continuation of an August 2026 wave, with changing package names and presentation but reused wallet interfaces, credential-handling logic, and network infrastructure.
- All identified extensions had been removed by October 5, 2026.
- Users who entered real wallet secrets into the fake interfaces should assume compromise, create a new wallet on a clean system, and move their assets.
- Organizations are advised to audit managed browser extensions and use runtime or behavior-based monitoring to detect suspicious activity.
Article Details
- Event Type
- Discovery of 16 malicious Firefox extensions impersonating cryptocurrency wallets.
- Impact
- The extensions intercept wallet recovery phrases and private keys and attempt to exfiltrate them to attacker-controlled infrastructure. Users who entered real credentials should assume their wallets are compromised; the extensions had been removed as of 2026-10-05.
People
Products
Google ChromeThe findings coincide with the discovery of several malicious or sketchy extensions for Firefox, Google Chrome, and Microsoft Edge in recent months -Microsoft EdgeThe findings coincide with the discovery of several malicious or sketchy extensions for Firefox, Google Chrome, and Microsoft Edge in recent months -Mozilla FirefoxCybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases and private keys.OKX WalletFour of these extensions are clones of Rabby Wallet, while the rest are targeted clones of OKX Wallet. All the identified add-ons barring one have been found to contact the "*.icy-star-f45c.workers[.]dev" domain. TheRabby WalletFour of these extensions are clones of Rabby Wallet, while the rest are targeted clones of OKX Wallet. All the identified add-ons barring one have been found to contact the "*.icy-star-f45c.workers[.]dev" domain. The