16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases

Security researchers identified 16 malicious Firefox extensions designed to impersonate legitimate cryptocurrency wallets, specifically Rabby and OKX Wallets. These extensions intercept and exfiltrate cryptocurrency wallet recovery phrases and private keys by sending them to attacker-controlled Cloudflare Workers domains. The extensions are part of an ongoing campaign that reuses infrastructure and code while rotating names and versions, indicating a persistent threat targeting cryptocurrency users.

AI-extracted · verify before operational use