Dangerous fake wallets discovered in Firefox: crypto can be stolen
Researchers discover three malicious Firefox extensions that mimic well-known cryptowallets. The fake wallets steal recovery phrases and private keys, giving criminals access to crypto coins.
Security researchers have uncovered three malicious browser extensions masquerading as well-known cryptowallets. The programs were on Firefox's official extension store and were designed to steal user access codes. Anyone who installed such a fake wallet runs the risk of losing their crypto coins.
Security company Socket announced on Tuesday 27 October that it had found three suspicious extensions. They posed as the popular crypto wallets Phantom, Jupiter and Bitget.
The criminals used almost identical names, logos and descriptions. As a result, users searching for a reliable wallet through Firefox could easily install a wrong version.
The extensions were designed to intercept recovery phrases and private keys. With this data, criminals can gain full control over a crypto wallet and lock away the available money.
According to Socket, the stolen data was forwarded to servers connected to the domain bonto[.]io.
Especially the fake version of Phantom was advanced. It could retrieve additional malicious software after approval by Firefox. This allowed the attackers to modify the behavior of the extension.
The criminals also tried to gain trust with misleading assessments. The number of reviews of the phony version of Phantom rose from 275 to 546 within two days.
All three extensions have now been removed from the Firefox store.
According to Socket, there are indications that the attackers also wanted to mimic Coinbase Wallet and Exodus. For these wallets, suspicious servers were detected, but no associated Firefox extensions.
Earlier this month, the security company discovered sixteen other malicious extensions that imitated Rabby and OKX Wallet, among others.
Socket advises users to install browser extensions exclusively through the official website of the wallet provider.
Anyone who has entered their recovery phrase or private key into a suspicious extension must immediately create a new wallet on a clean device and transfer their crypto coins. Just removing the extension is not enough. Once criminals have captured a recovery phrase, they can keep access to the corresponding wallet even without the malicious software.