{"id":3437,"date":"2026-10-08T10:26:21","date_gmt":"2026-10-08T10:26:21","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3437"},"modified":"2026-10-08T10:26:21","modified_gmt":"2026-10-08T10:26:21","slug":"16-malicious-firefox-extensions-pose-as-rabby-and-okx-wallets-to-steal-recovery-phrases","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3437","title":{"rendered":"16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Oct 08, 2026<\/span><\/span><span class=\"p-tags\">Browser Security \/ Malware<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh25slDP7PhWH155CxM4JUNITLHKzjfSXpuF4WWZJmkycx5UQUIjLJd5Jg_mEDQi62FwRkfpLV14DBpVu2pybVwacKkHpc2MABge_OjMCn3ISyUTsh_JS0fM3wgzv4hbR1du-9fp7cmd0vvB33xeCv7RD7-o4A66gCoKtuCQxmmQL2jM2ljZOMyude3uhOb\/s1700-nu-rw-lo-l85-e365\/firefox-plugins.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases and private keys.<\/p>\n<p>\u00abThe extensions masquerade as wallet portals, desktop utilities, and browser tools, but their code intercepts recovery phrases and private keys during wallet import flows and attempts to send those secrets to attacker-controlled Cloudflare Workers,\u00bb Socket researcher Joseph Edwards <a href=\"https:\/\/socket.dev\/blog\/firefox-crypto-wallet-stealers\" target=\"_blank\">said<\/a> in an analysis.<\/p>\n<p>The names of the extensions are below &#8211;<\/p>\n<ul>\n<li>view-focus-bright@webtools.co@6.12.2<\/li>\n<li>quick-track-nest@tabtools.co@8.1.18<\/li>\n<li>vibe-kit-tool@fasttools.co@9.21.9<\/li>\n<li>edge-hub-snap@protools.net@4.12.24<\/li>\n<li>core-hub-peak@neattools.example@8.24.21<\/li>\n<li>sipoo-grozza@browserweb.com@2.1<\/li>\n<li>mozart-seo@webtools.com@1.4<\/li>\n<li>clean-file-bar@neattools.com@4.21.8<\/li>\n<li>clean-net-timer@plugify.example@4.17.1<\/li>\n<li>manager-square@webtools.com@1.4<\/li>\n<li>manager-course@webtools.com@1.4<\/li>\n<li>val-andrew@browserweb.com@1.4<\/li>\n<li>manager-team@browserweb.com@1.4<\/li>\n<li>valory-andrew@browserweb.com@1.4<\/li>\n<li>franklin-uk@browserweb.com@1.4<\/li>\n<li>franklin-uro@browserweb.com@1.4<\/li>\n<\/ul>\n<p>Four of these extensions are clones of Rabby Wallet, while the rest are targeted clones of OKX Wallet. All the identified add-ons barring one have been found to contact the \u00ab*.icy-star-f45c.workers[.]dev\u00bb domain. The end goal is to collect mnemonic phrases and private keys and exfiltrate them to the Cloudflare Workers domain.<\/p>\n<p>The activity is assessed to be a continuation of an earlier wave that the application security company documented in August 2026. The findings suggest that the threat actors are rotating package names, versions, extension IDs, descriptions, and the presentation layer, while reusing the same wallet interfaces, credential-handling logic, and network infrastructure.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>As of October 5, 2026, all the extensions have been removed. Users who have installed any of the aforementioned extensions and entered a real recovery phrase or private key into the fake wallet interfaces should assume compromise, create a new wallet from a clean system, and move their assets.<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>The findings coincide with the discovery of several malicious or sketchy extensions for Firefox, Google Chrome, and Microsoft Edge in recent months &#8211;<\/p>\n<ul>\n<li>A Firefox extension called \u00ab<a href=\"https:\/\/socket.dev\/blog\/firefox-google-account-takeover\" target=\"_blank\">ID- Pay<\/a>\u00bb (pdf-para-texto@extensao.local) that poses as a utility for identity verification before opening protected PDF documents, but harbors functionality to fetch a remote payload from attacker-controlled infrastructure and inject JavaScript into the legitimate \u00abaccounts.google[.]com\u00bb domain to steal session cookies.<\/li>\n<li>A <a href=\"https:\/\/www.akamai.com\/blog\/security-research\/when-productivity-extensions-become-attack-platforms\" target=\"_blank\">cluster of 32 malicious browser extensions<\/a> across the Chrome Web Store and Microsoft Edge Add-ons Store that masquerades as benign productivity utilities, but harvest data, monitor user browsing habits, and stealthily replace the active tab with a destination URL specified in a remotely-retrieved configuration. The campaign has been active since March 2025 and attributed to a Korean-speaking threat actor.<\/li>\n<li>A <a href=\"https:\/\/www.akamai.com\/blog\/security-research\/crypto-scam-extensions-masquerade-high-profile-investors\" target=\"_blank\">cluster of about 30 malicious browser extensions<\/a> that masquerade as productivity tools, privacy utilities, and cryptocurrency-related services published under the names of legitimate, high-profile financial personalities with the goal of redirecting victims to cryptocurrency wallet phishing pages designed to steal recovery phrases, while skipping English-speaking users and analysis environments.<\/li>\n<li>A <a href=\"https:\/\/riskyplugins.com\/threat-library\/russian-vpn-proxy-farm\" target=\"_blank\">cluster of 31 Russian-language Chrome extensions<\/a> that are advertised as VPNs for a specific blocked service in the country (e.g., Anthropic Claude, Facebook, Google Gemini, LinkedIn, Netflix, Notion, OpenAI ChatGPT, Spotify, Telegram, Threads, Wikipedia, X, and YouTube) but routes browser traffic through a proxy whose server list is fetched from a GitHub Pages URL (or Blogger, Google Docs, and Telegram for redundancy) post-installation.<\/li>\n<li>A Chrome Web Store extension named <a href=\"https:\/\/amibeingpwned.com\/extensions\/stylish\" target=\"_blank\">Stylish<\/a> that <a href=\"https:\/\/amibeingpwned.com\/blog\/ai-chat-scraper-wall-of-shame\" target=\"_blank\">intercepts<\/a> every ChatGPT, Gemini, Claude, Perplexity, Character.AI, and GitHub Copilot conversation and forwards the full response text to its operator.<\/li>\n<li>A Chrome Web Store extension named \u00ab<a href=\"https:\/\/amibeingpwned.com\/blog\/anatomy-of-a-malicious-extension\" target=\"_blank\">Urban VPN<\/a>\u00bb that includes an \u00abanti-phishing\u00bb feature designed to warn users before visiting any harmful sites, but never returns a phishing warning and silently transmits visited URLs to servers operated by BIScience. Urban VPN was previously accused of capturing user conversations with AI chatbots. However, the extension developers <a href=\"https:\/\/www.urban-vpn.com\/blog\/setting-the-record-straight-how-urban-vpns-ai-protection-feature-actually-works\/\" target=\"_blank\">clarified<\/a> that AI-related processing only occurs after the \u00abAI Protection\u00bb feature was explicitly enabled. Earlier this May, the add-on developers also <a href=\"https:\/\/amibeingpwned.com\/blog\/urban-vpn-postmessage-command-injection\" target=\"_blank\">addressed<\/a> a high-severity security vulnerability that allowed any website to send arbitrary commands to the extension without origin verification.<\/li>\n<li>A Chrome Web Store extension named \u00ab<a href=\"https:\/\/amibeingpwned.com\/extensions\/poper-blocker\" target=\"_blank\">Pop up blocker for Chrome\u2122 &#8211; Poper Blocker<\/a>\u00bb that&#8217;s marketed as an ad blocker but <a href=\"https:\/\/amibeingpwned.com\/blog\/poper-blocker-the-adblocker-that-spies-on-you\" target=\"_blank\">ships an interpreter<\/a> that downloads and interprets instructions from a command-and-control (C2) server, circumventing Google&#8217;s <a href=\"https:\/\/developer.chrome.com\/docs\/webstore\/program-policies\/mv3-requirements#:~:text=Building%20an%20interpreter%20to%20run%20complex%20commands%20fetched%20from%20a%20remote%20source%2C%20even%20if%20those%20commands%20are%20fetched%20as%20data\" target=\"_blank\">Manifest V3 rules<\/a> banning this behavior. The commands allow it to collect browser fingerprints, browsing history, social media profile information, and AI chatbot interactions.<\/li>\n<\/ul>\n<p>To counter the threat associated with malicious extensions, users are advised to review the browser extensions installed in their environment, and remove those that are no longer needed. Organizations are recommended to audit extensions within managed environments, adopt runtime monitoring approaches, and deploy behavior-based extension monitoring technologies to detect suspicious activity.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Oct 08, 2026Browser Security \/ Malware Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases and private&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3438,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[361,510,33,3711,1402,2150,3710,1050,571,617],"class_list":["post-3437","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-extensions","tag-firefox","tag-malicious","tag-okx","tag-phrases","tag-pose","tag-rabby","tag-recovery","tag-steal","tag-wallets"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3437"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3437\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3438"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3437"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}