Cybersecurity experts have identified 16 harmful Mozilla Firefox add-ons that target cryptocurrency users by stealing recovery phrases and private keys. These malicious extensions disguise themselves as legitimate tools but secretly intercept sensitive information during wallet setup processes, passing it to servers controlled by attackers.
Deceptive Appearance and Operation
The identified extensions present themselves as wallet managers and browser utilities. However, their true function is to capture and transmit recovery phrases and private keys to a domain managed by attackers, specifically the “*.icy-star-f45c.workers[.]dev”. This malicious activity is seen as a continuation of similar threats reported earlier in August 2026.
Among the extensions, four are clones of Rabby Wallet, and the rest mimic OKX Wallet, highlighting a targeted approach. The attackers frequently modify package identifiers and visual elements while maintaining the same underlying malicious code and infrastructure.
Impact on Users and Recent Trends
All of the identified extensions were removed by October 5, 2026. Users who have interacted with these extensions and entered genuine recovery phrases should consider their wallet compromised. It is recommended to establish new wallets on secure systems and transfer assets immediately.
This discovery aligns with a broader trend of malicious or dubious browser extensions affecting Firefox, Google Chrome, and Microsoft Edge users. Notable incidents include extensions designed to steal session cookies from Google users and others that secretly track browsing activity or redirect users to phishing sites.
Preventive Measures and Recommendations
To mitigate risks from such malicious add-ons, users should regularly audit their browser extensions, removing any that are unnecessary or suspicious. Organizations managing browser environments are advised to implement runtime monitoring and behavior-based detection systems to identify and neutralize potential threats promptly.
In conclusion, vigilance in managing browser extensions and staying informed about emerging threats are critical steps in safeguarding personal and organizational cyber security. As cyber threats continue to evolve, proactive measures remain the best defense against data breaches and privacy violations.
