Malicious Firefox Extensions Target Users with Fake Wallets, Putting Recovery Phrases at Risk
A new wave of malicious Firefox extensions has been discovered, targeting users with fake wallets that pose as Rabby and OKX wallets. These rogue add-ons have managed to slip past Mozilla’s review process, compromising the security of thousands of users who have installed them. The extensions are designed to steal sensitive information, including recovery phrases used for cryptocurrency wallet backups.
The malicious extensions work by using a technique called cross-domain privilege escalation (CDPE). This allows them to bypass Firefox’s built-in security features and gain access to sensitive data stored in other domains. Once inside, the malware can extract recovery phrases from users’ wallets, giving attackers full control over their digital assets. The affected users are likely unaware of the compromise, as the extensions blend seamlessly into the browser’s interface.
Mozilla has a reputation for being vigilant about reviewing and approving add-ons for Firefox. However, in this case, it appears that these malicious extensions were able to evade detection. As a result, thousands of users who have installed the fake Rabby or OKX wallet extensions are at risk of having their recovery phrases compromised. The attackers can then use this information to reset passwords, drain wallets, and steal cryptocurrency.
The severity of the issue is compounded by the fact that many users rely on these types of extensions for managing their digital assets. The ease with which these malicious extensions were able to slip past Mozilla’s review process highlights a critical vulnerability in the browser’s security framework. This raises questions about the effectiveness of current security measures and whether they are sufficient to protect against such threats.
The emergence of this threat serves as a stark reminder that even seemingly legitimate software can be compromised by malicious actors. Users need to remain vigilant and take proactive steps to protect themselves, including regularly reviewing installed extensions and being cautious when downloading new add-ons. In particular, users should exercise extreme caution when installing extensions that claim to manage cryptocurrency wallets or provide wallet-related services.
In the face of this threat, it’s essential for users to understand the risks associated with these malicious extensions. By staying informed about the latest security threats and taking steps to protect themselves, users can minimize their exposure to these types of attacks.
Source: The Hacker News — 2026-10-08