A cluster of 16 malicious Firefox extensions has been caught masquerading as legitimate crypto wallets (Rabby, OKX) and browser utilities. Their payload is straightforward: they hook into wallet import flows to exfiltrate recovery phrases and private keys to attacker-controlled infrastructure.
Technical Breakdown – TTPs: Masquerading (T1036), Input Capture (T1056.001) via injected content scripts, Exfiltration over C2 (T1041). – IOCs: The extensions were distributed via the Mozilla Add-ons store. Specific extension names and C2 domains are not yet publicly enumerated, but the core behavior is intercepting form data during wallet setup/import. – Affected: Mozilla Firefox (all platforms). Extensions posing as Rabby Wallet, OKX Wallet, and generic "desktop utilities."
Defense – Detection: Monitor for unexpected content scripts injecting into chrome:// or about: pages, or network calls to unknown domains immediately following wallet import flows. – Mitigation: Remove any unrecognized extensions immediately. Verify wallet extensions only through official project websites (e.g., rabby.io), not the add-on store. Enable extension signing enforcement in Firefox.
Source: https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html
Source: r/SecOpsDaily · by /u/falconupkid