Fake extensions for popular crypto wallets have been discovered in Firefox

Researchers from Socket’s Threat Research Team discovered three malicious programs in the Mozilla Firefox add-ons store that were masquerading as the popular crypto wallets Phantom, Jupiter, and Bitget. The attackers copied the names, icons, and promotional descriptions of the genuine apps—making it nearly impossible for the average user to distinguish the fakes from the originals.

The fake extension named Phantom used visually similar symbols to look identical to the real one and was distributed under the name Official Phantom Wallet (Firefox Update). The fake Jupiter was marketed as an official product of Jupiter Exchange, while the malicious Bitget extension hid behind the name «TabFlow Pro» but displayed the branding of the original wallet to users.

The malware impersonating Phantom intercepted 12-, 15-, 18-, or 24-word mnemonic phrases and private keys for the Ethereum and Solana networks. It read the contents of text fields and tracked text pasted via the clipboard, then sent the stolen data to the attackers' server in JSON format. The Jupiter and Bitget imposters operated more simply—they sent mnemonic phrases directly to the subdomains jupiter[.]bonto[.]io and bitget[.]bonto[.]io.

The fake Phantom package contained its own backend drainer—the Node. js file `server.js`. It stored the stolen data locally, simultaneously sent it to a Telegram bot, and then automatically initiated the transfer of assets to pre-prepared addresses on the Bitcoin, Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, and Solana. The fake Jupiter also requested access to Trezor Connect.

To make the extensions appear more trustworthy, the scammers artificially inflated the ratings. In just a few days, the number of reviews for the fake Phantom rose from 275 to 546, and the rating jumped from 2.9 to 3.9 stars. It is not known how many users were affected or how much money was stolen.

All three extensions have already been removed from Firefox. However, this is not the first such incident: previously, the same Socket team discovered 16 malicious extensions that copied the interfaces of the Rabby and OKX wallets, masquerading as wallet portals, desktop utilities, and browser tools.