Socket Threat Research identified 16 malicious Firefox extensions that cloned Rabby Wallet and OKX Wallet interfaces to capture recovery phrases and private keys.
Four variants copied Rabby and 12 targeted OKX users. Fifteen sent stolen secrets to one Cloudflare Worker, while a separate packaged variant used another endpoint but appears to have been broken as shipped, according to Socket’s technical analysis.
The extensions declared that they collected no Firefox data even though their code handled and transmitted wallet recovery material. Socket linked the campaign to infrastructure and techniques it documented in an earlier investigation.
Mozilla had unpublished the identified extensions by 5 October. Removal from the store does not protect a wallet if a user already entered a seed phrase or private key into a functioning malicious extension.
TOKEN RECON ASSESSMENT
A stolen seed phrase cannot be secured by changing an extension password or deleting the browser add-on. Anyone who entered recovery material into one of the listed extensions should treat the wallet as compromised, create a new wallet from a clean environment, and move assets after verifying the new software through the wallet provider’s official site. Search placement and browser-store availability were not proof of legitimacy.
Sources
Socket Threat Research, 16 Firefox crypto wallet stealers
Socket Threat Research, broader Firefox wallet theft campaign
