New Browser Security Threat: 16 Malicious Firefox Extensions Target Cryptocurrency Wallet Credentials

Cybersecurity researchers have identified 16 malicious Mozilla Firefox browser extensions designed to compromise cryptocurrency wallet credentials by impersonating legitimate wallet applications.

The extensions specifically target recovery phrases and private keys, which provide access to cryptocurrency assets and associated blockchain accounts.

According to research conducted by Socket Threat Research, the malicious extensions imitate the interfaces and functionality of established cryptocurrency wallet providers, including Rabby Wallet and OKX Wallet.

The findings highlight the growing security risks associated with untrusted browser extensions and demonstrate how attackers exploit familiar application interfaces to facilitate credential theft.

The investigation identified four extensions impersonating Rabby Wallet and 12 extensions designed to resemble OKX Wallet.

The attack primarily targets users during cryptocurrency wallet import procedures.

When victims enter their recovery phrases or private keys into the fraudulent interfaces, embedded malicious code attempts to collect the sensitive information and transmit it to attacker-controlled infrastructure.

Researchers identified Cloudflare Workers endpoints being used as exfiltration destinations. Depending on the extension variant, the stolen information could be transmitted through HTTP GET requests or HTTPS POST operations.

Further analysis revealed that the threat actors frequently modified extension names, version numbers, identifiers, and descriptions while preserving shared malicious components and communication infrastructure.

These findings suggest a coordinated and repeatable campaign rather than isolated malicious extensions.

Some measures we should take to protect against these types of attacks include:

• Application impersonation: Threat actors can replicate legitimate application interfaces to deceive users into revealing confidential information.

• Credential and data exposure: Malicious extensions can collect sensitive information and transmit it to unauthorized external systems.

• Browser attack surface: Excessive extension permissions may increase organizational exposure to malicious activities.

• Third-party software risk: Unverified browser extensions can weaken established security controls and increase supply chain-related risk.The compromise of a cryptocurrency wallet recovery phrase is particularly critical because possession of this information may allow an attacker to gain control over associated assets.

For detailed information, you can contact our experts at info@zerosecond.ae