16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials

Socket Threat Research identified a coordinated campaign involving 16 malicious Firefox extensions designed to steal cryptocurrency wallet recovery phrases and private keys. The extensions impersonate legitimate wallets such as Rabby and OKX, using cloned interfaces to trick users into revealing sensitive information. Stolen credentials are exfiltrated to attacker-controlled Cloudflare Workers. Fifteen of the extensions communicate with the domain icy-star-f45c[.]workers[.]dev, while one uses a different endpoint. Mozilla has since unpublished the malicious extensions, but users who entered wallet recovery data should consider their wallets compromised and take immediate remediation steps.

AI-extracted · verify before operational use