16 Firefox Wallet Fakes, DarkSword Hit Crypto Users [2026]

Two separate crypto wallet seed phrase theft campaigns surfaced within 72 hours of each other in early October 2026, and together they show how far attackers have moved beyond the classic phishing email. Socket Threat Research disclosed 16 malicious Firefox extensions on October 7 that cloned the interfaces of Rabby Wallet and OKX Wallet to capture 12-word and 24-word recovery phrases. One day later, researchers at Censys published findings on a separate operation called DarkSword and its companion malware Coruna, an iOS exploitation platform that had already harvested recovery phrases directly from compromised iPhones.

Neither campaign stole from an exchange or a smart contract. Both went straight for the one secret that nothing else can substitute: the seed phrase that recreates a wallet’s private keys. That distinction matters for anyone who has spent 2026 reading headlines about nine-figure exchange breaches and DeFi exploits, because it points to where the next wave of losses is likely to come from.

A Rough Week for Crypto Wallet Seed Phrase Security

Security researchers have tracked a steady shift in how criminals go after cryptocurrency. Rather than attack a blockchain’s cryptography directly, which is still computationally out of reach, attackers target the software and hardware layer where a human has to type, store, or move a seed phrase. The Firefox extension cluster and the DarkSword/Coruna platform both sit in that category, and both surfaced in the same week, which is why security teams are treating them as a single story rather than two unrelated incidents.