77 Malicious Firefox Extensions Steal Crypto Wallet Secrets and Credentials

Socket Threat Research documents a campaign of 77 malicious or deceptive Firefox extensions impersonating Web3 wallets (e.g., OKX, Rabby, TronLink) that exfiltrate recovery phrases, private keys, keyrings, credentials, and clipboard data to attacker-controlled cloud services (Supabase, Cloudflare Workers) and HTTP C2 servers; researchers confirmed 40 malicious extensions and identified multiple theft techniques and clusters, warning users to avoid entering wallet secrets into extension popups and to install wallets only from official sources.