16 Malicious Firefox Extensions Impersonate Rabby and OKX Wallets to Steal Keys
Researchers identified 16 fake browser add-ons that intercept cryptocurrency wallet secrets during import processes.
Key points
- Sixteen malicious extensions target Firefox users by posing as legitimate wallet tools.
- The add-ons intercept private keys and recovery phrases during wallet import flows.
- Attackers masquerade as Rabby and OKX wallet portals to deceive victims.
Cybersecurity researchers have identified a cluster of sixteen malicious Mozilla Firefox extensions designed to steal cryptocurrency wallet credentials. According to a report by The Hacker News, these add-ons masquerade as legitimate wallet portals, desktop utilities, and browser tools to trick users into installing them.
The primary function of these malicious extensions is to intercept sensitive data during the wallet import process. When users attempt to import their wallets using the fake extensions, the code captures recovery phrases and private keys. The extensions then attempt to transmit these stolen secrets to external servers controlled by the attackers. The campaign specifically targets users of popular cryptocurrency wallets, with the malicious add-ons posing as official tools for Rabby and OKX.
Deceptive Distribution Tactics
The threat actors behind this campaign rely on visual deception and name confusion to bypass user scrutiny. By presenting the extensions as official desktop utilities or browser tools associated with well-known wallet providers, the attackers aim to lower the victim's guard. The extensions do not merely display ads or track browsing history; they actively manipulate the wallet import flow. This allows them to capture the exact moment a user inputs their most critical security credentials. The use of Firefox as the target platform suggests a specific focus on users who may rely on browser-based wallet management tools.
Impact on Crypto Users
Users who install any of the sixteen identified extensions risk the immediate compromise of their cryptocurrency holdings. Because the extensions capture private keys and recovery phrases, attackers gain full control over the associated wallets. This allows them to transfer funds out of the victim's account without further interaction. The targeting of Rabby and OKX indicates that users of these specific services are at higher risk, particularly if they search for unofficial helper tools or desktop integrations.
What should you do?
Security professionals and individual users should audit their installed browser extensions immediately. Look for any add-ons related to wallet management that were not downloaded directly from the official vendor websites. If an extension is found that matches the description of impersonating Rabby or OKX tools, it should be removed. Users should also verify the integrity of their wallet credentials by checking for unauthorized transactions.
What to do and how to stay safe: Firefox
- Review the list of installed extensions in your Firefox browser settings and remove any unrecognized or suspicious wallet-related add-ons.
- Verify that you downloaded wallet tools only from the official vendor websites or official browser extension stores, checking the developer name carefully.
- Monitor your cryptocurrency wallets for any unauthorized outgoing transactions or changes in balance.
- If you suspect you have entered your recovery phrase or private key into a malicious extension, move your funds to a new wallet with freshly generated credentials immediately.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which wallets are being impersonated by these malicious extensions?
The extensions pose as tools for Rabby and OKX wallets.
How do these extensions steal user data?
They intercept recovery phrases and private keys during the wallet import process.
Which browser is targeted by this campaign?
The malicious extensions are designed for Mozilla Firefox.
