16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases

Researchers discovered a cluster of 16 malicious Firefox extensions that masquerade as wallet portals and utilities to intercept crypto wallet recovery phrases and private keys during import flows, exfiltrating them to a Cloudflare Workers domain (*.icy-star-f45c.workers.dev). Several extensions are Rabby and OKX clones; the campaign reuses credential-handling logic and infrastructure from prior waves, all identified extensions were removed as of 2026-10-05, and affected users are advised to assume compromise and recreate wallets from a clean system.