Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets

A cluster of malicious Firefox extensions impersonating popular cryptocurrency wallets—Phantom, Jupiter, and Bitget—has been identified, stealing recovery phrases and private keys from users. The extensions use Unicode homoglyphs to mimic legitimate wallet names and deploy both bundled stealers and remote payload loaders to exfiltrate credentials. Stolen data is sent to subdomains of the command-and-control domain bonto[.]io, with infrastructure indicating targeting of additional wallets like Coinbase and Exodus. One variant also includes a Node.js-based drainer backend that automatically sweeps stolen funds across multiple blockchains.

AI-extracted · verify before operational use