Cybersecurity
Sixteen Firefox extensions steal crypto wallet recovery phrases
Researchers said 16 Firefox extensions copied Rabby Wallet and OKX Wallet interfaces, captured recovery phrases and private keys during import flows, and sent them to attacker-controlled Cloudflare Workers.
- Socket researcher Joseph Edwards said the extensions intercepted recovery phrases and private keys while users imported wallets.
- Four of the add-ons imitated Rabby Wallet, while the others targeted OKX Wallet.
- All but one of the identified extensions contacted the *.icy-star-f45c.workers.dev domain.
- Socket assessed the activity as a continuation of an earlier wave it had documented in August 2026.
- By 5 October 2026, all of the extensions had been removed.
Researchers said 16 Mozilla Firefox extensions were built to steal cryptocurrency wallet recovery phrases and private keys. Socket researcher Joseph Edwards said they disguised themselves as wallet portals, desktop tools and browser utilities.
According to Edwards, the code captured secrets during wallet import flows and tried to send them to attacker-controlled Cloudflare Workers. Four of the add-ons copied Rabby Wallet, and the rest copied OKX Wallet.
Socket said nearly all of the identified extensions reached out to the *.icy-star-f45c.workers.dev domain. The company said the operators had changed package names, versions, extension IDs, descriptions and presentation, while keeping the same wallet interfaces, credential-handling logic and network setup.
Socket said the campaign continued an earlier wave it had documented in August 2026. It said the extensions were removed by 5 October 2026.
The article said people who entered a real recovery phrase or private key into the fake interfaces should treat the wallet as compromised. It advised creating a new wallet on a clean system and moving assets.
Named in this story
People
- Joseph Edwards
- a Socket researcher who analysed the extensions
Companies
- Socket
- the security company that documented the campaign
Products and systems
- Rabby Wallet
- the wallet brand cloned by four of the extensions
- OKX Wallet
- the wallet brand cloned by the rest
- Cloudflare Workers
- the service used to receive stolen secrets
How the source tells it
The register was matter-of-fact, with a brief remedial warning at the end.
No emotive framing was found in the original.