16 Malicious Firefox Extensions Target Crypto Wallets in Sophisticated 2026 Campaign
In October 2026, cybersecurity researchers discovered 16 malicious Mozilla Firefox extensions masquerading as legitimate Rabby and OKX cryptocurrency wallets. These extensions specifically targeted cryptocurrency users by intercepting wallet recovery phrases and private keys during import flows, then exfiltrating the stolen credentials to attacker-controlled Cloudflare Workers infrastructure. The campaign represents a continuation of earlier attacks documented in August 2026, with threat actors rotating package names and extension identifiers while reusing the same credential-harvesting logic and network infrastructure. All identified extensions have been removed from the Firefox add-on store as of October 5, 2026. This incident highlights the growing sophistication of cryptocurrency-focused malware campaigns and the increasing abuse of browser extension ecosystems for credential theft. The attack demonstrates how threat actors are systematically targeting the expanding cryptocurrency user base through trusted distribution channels, making extension security and wallet hygiene critical priorities for organizations and individuals managing digital assets.
Kill Chain
