Network of 77 Firefox extensions linked to crypto theft uncovered

Cyber Insider reports that a network of 77 Firefox extensions has been discovered, with a significant portion actively engaged in cryptocurrency wallet theft, credential harvesting, and deceptive software distribution.

Socket researchers identified 40 malicious extensions and 37 others disguised as unrelated utilities, all linked through shared code, infrastructure, and publishing artifacts. The operation, active from at least March to August, saw extensions impersonating crypto products and acting as phishing loaders. Some extensions embedded wallet-theft code directly, stealing recovery phrases during wallet creation or import, while others transmitted serialized keyring information before local encryption. Additionally, 13 extensions modified Rabby Wallet code to exfiltrate data. Another five targeted credentials and clipboard contents.

The remaining 37 extensions, while appearing to offer sports scores, had historical ties to wallet-stealing operations. Users who installed malicious extensions should assume their wallet information is compromised and move funds to a new wallet, change passwords, and review browser activity.

Source: