In a significant cybersecurity incident, three Firefox browser extensions have been identified as malicious tools designed to steal sensitive data from crypto wallets. These extensions, masquerading as legitimate versions of the Phantom, Jupiter, and Bitget wallets, were actively available in the Firefox Add-ons store before being removed. The breach highlights the ongoing risks associated with browser extensions, especially those related to cryptocurrency.
How Malicious Extensions Operate
The fake extensions replicated the branding of well-known crypto wallets, including their names and icons, to deceive users. This tactic is part of a broader pattern seen in other scams where attackers attempt to capture unsuspecting users’ sensitive information. The extensions were discovered by researchers at Socket.dev, who reported their findings on October 27, 2026.
These extensions functioned by sending stolen recovery phrases and private keys to a specific domain, bonto[.]io. Notably, the Phantom extension also contained a hidden loader capable of altering its functionalities post-approval from Mozilla, raising further concerns about the review process’s robustness.
Technical Aspects of the Breach
The Phantom extension used lookalike Unicode characters to appear legitimate and was branded as the ‘Official Phantom Wallet (Firefox Update).’ Similarly, the Jupiter and Bitget extensions falsely claimed affiliations with respective exchanges. None of the extensions provided a privacy policy, misleading users into a false sense of security.
Particularly concerning was the Phantom extension’s ability to fetch a settings file from a hidden server, which contained a base64-encoded data stealer. This code executed on every page the user visited, capturing critical wallet information. The attackers could manipulate the server to deliver benign responses during official reviews and activate harmful scripts afterward.
Implications and Preventive Measures
The incident underscores the vulnerabilities inherent in browser extensions, especially those linked to financial services. Users are advised to install extensions only via the official websites of wallet providers. Importantly, if any sensitive information was entered into these extensions, users should immediately create a new wallet on a secure device and transfer their funds to it.
For organizations, it is crucial to block domains associated with these malicious activities, such as bonto[.]io, and monitor for extensions that dynamically load external scripts. This proactive approach will help mitigate similar threats in the future.
This campaign is reminiscent of previous attacks, indicating a pattern of exploiting browser extensions to target cryptocurrency users. As cyber threats continue to evolve, staying informed and adopting rigorous security practices remain vital.
