40 Fake Crypto Wallet Extensions Found on Firefox

Forty malicious browser extensions have been identified on Firefox, impersonating legitimate crypto wallets including OKX, Rabby, and TronLink. The fake extensions are designed to harvest seed phrases entered by users, giving attackers immediate and full access to any wallet associated with those phrases. The attack vector is straightforward. A user searches for a wallet extension in the Firefox Add-ons store, selects what appears to be the official extension, installs it, and enters their seed phrase during setup. The malicious extension captures the phrase and transmits it to the attacker before the user has any indication something is wrong. How to protect yourself: install wallet extensions only by navigating directly to the official project website and following the link they provide, never by searching the browser store directly. Before installing, verify the publisher name and check the total number of reviews and users — legitimate wallets have hundreds of thousands of users and a long review history. If you have already installed a wallet extension without verifying it through the official site, move your funds to a new wallet immediately.