16 Fake Rabby and OKX Firefox Extensions Stole Crypto Wallet Recovery Phrases
ID: 2188f4d8-4ccd-5a35-a590-b83d9d771593
STIX ID: report--2188f4d8-4ccd-5a35-a590-b83d9d771593
Feed Name: securityonline.info
Threat Score
Sixteen malicious Firefox add-ons cloned Rabby and OKX wallets; when users imported wallets the extensions captured recovery phrases and private keys and sent them to Cloudflare Workers. Mozilla removed the listings, but anyone who entered a real phrase or key should create a new wallet on a clean device and move funds immediately; Socket links this activity to an earlier August 2026 campaign and provides hunting indicators.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.