16 Firefox Extensions Caught Stealing Crypto Wallet Recovery Phrases and Private Keys

Threat Research/SOCKET uncovered a coordinated campaign of 16 malicious Firefox extensions (four Rabby Wallet clones and twelve OKX-style clones) that capture 12/24-word recovery phrases and 64‑char private keys during wallet import flows and exfiltrate them to attacker-controlled Cloudflare Workers (e.g., silent-wind-get.icy-star-f45c.workers.dev); Mozilla unpublished the extensions but wallets with exposed secrets remain at risk, and indicators of compromise and campaign markers (EQOx7EIPZSNi) are provided.