Reported by 2 outlets
16 Malicious Firefox Extensions Impersonate Crypto Wallets to Steal Seed Phrases and Private Keys
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.50 / 2.0 · updates in 48h
- Pickup speed
- 0.56 / 0.6 · time to second source
- Recency
- × 0.39 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 1.7 / 10 = base × recency + community
Desk analysis
Socket's October 7 report identified 16 malicious Firefox extensions that impersonate cryptocurrency wallet portals, desktop utilities, and browser tools. By October 5, Mozilla had unpublished the extensions. The packages attempt to intercept recovery phrases and private keys during wallet imports and transmit secrets to attacker-controlled Cloudflare Workers.
Fifteen of the packages contain malicious payloads directed at crypto wallet users. This is a browser-extension supply-chain and social-engineering threat rather than a vulnerability with a CVE. The primary sourcing comes from GBHackers citing Socket's analysis, with updates from The Hacker News.
Users should verify extension publishers, avoid importing seed phrases into unverified browser tools, and remove any extension matching the reported impersonator names.
Timeline
-
original reporting
16 Malicious Firefox Extensions Impersonate Crypto Wallets to Steal Seed Phrases and Private Keys
gbhackers.com · 5d ago · October 8th, 2026
16 malicious Firefox extensions that impersonate cryptocurrency wallets to intercept recovery phrases and private keys during wallet imports. Disguised as wallet portals, desktop utilities, and browser tools, the packages attempt to transmit secrets to attacker-controlled Cloudflare Workers. Mozilla had unpublished the extensions by October 5, 2026, according to Socket’s October 7 report. Fifteen packages contain […] The post 16 Malicious Firefox Extensions Impersonate Crypto Wallets to Steal Seed Phrases and Private Keys appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from thehackernews.com
🤖 16 malicious Firefox extensions posing as Rabby/OKX wallet portals and desktop tools intercept seed phrases and private keys during wallet
thehackernews.com · 5d ago · October 8th, 2026
🤖 16 malicious Firefox extensions posing as Rabby/OKX wallet portals and desktop tools intercept seed phrases and private keys during wallet
via Mastodon https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html
-
mentioned by thehackernews.com
Cybersecurity alert: 16 malicious Firefox extensions hide as wallet tools, stealing crypto recovery phrases and private keys during import.
thehackernews.com · 1d ago · October 12th, 2026