On 7 October 2026 Socket (Joseph Edwards) published research on 16 malicious Firefox extensions that impersonate crypto wallets. Socket says Mozilla unpublished them as of 5 October. The campaign is a reminder that a fake wallet has to ask for the one thing a real wallet never sends anywhere, which is the recovery phrase.
What happened
Socket describes two groups. Four are large clones of Rabby Wallet, rebranded with a lookalike name. Twelve are compact clones styled like OKX Wallet and presented as "Portal WALLET". Of the twelve, Socket says eleven are operational and one is broken as shipped.
The extensions hook wallet import flows and capture 12 or 24 word recovery phrases and 64 character hexadecimal private keys as users enter them. The Rabby clones send secrets in GET query parameters, and the OKX style clones send JSON by POST. One variant uses sendBeacon, fetch and an image pixel fallback. Destinations are Cloudflare Workers hosts. Every manifest declares no data collection, and in one variant a code comment says only a hash is sent while the code sends the raw phrase.
Socket assesses with high confidence that this continues activity it reported in August, based on shared infrastructure, tactics, lures and a campaign marker. It says the extensions appear generated by a builder pipeline with names varied and payload code fixed.
Confirmed, reported and unknown
Reported by Socket from analysis: the list of 16 IDs, the behavior, the hosts and the hashes, all in its post. Mozilla's unpublishing is as Socket states it.
Unknown: how victims found the extensions, install and victim counts, whether stolen secrets were used, who operates the campaign, whether the Workers endpoints remain active, and why the 5 October unpublishing predates the 7 October article.
What to do now
- Check Firefox profiles for the extension IDs Socket lists, and remove them.
- If anyone entered a real recovery phrase or key into any of them, treat that wallet as compromised and move assets to a new wallet created on a clean device.
- Get wallets only from the vendor's own site, and check the publisher on the store page.
- For organizations, block the Workers hosts Socket lists and add the IDs to the extension blocklist.
How this could have been avoided
- Never type a recovery phrase into a browser extension you did not install from the vendor's verified page.
- Compare the extension's publisher, name spelling and listing age with the real product. "Raabby WaIIet" with capital I letters in place of l is visible on close reading.
- Use a hardware wallet for meaningful funds, since signing happens on the device and the phrase is never typed into a browser.
- Allow only reviewed extensions in managed browsers.
Quick check
Why is a manifest saying "no data collection" not evidence of safety?
The manifest is a declaration by the publisher. In this campaign every manifest declared none while the code sent recovery phrases out.
