Researchers at Socket have exposed three malicious Firefox extensions that posed as well-known cryptocurrency wallets and were designed to steal the secrets that control a wallet. The add-ons copied the names, icons and marketing of Phantom, Jupiter and Bitget, so a user searching the Firefox add-ons store could install one by mistake. All three listings were live during the research and had been removed by the time Socket published its findings on 27 October 2026.

How the fakes captured wallet secrets

All three packages contained code built to collect recovery phrases and private keys, the strings that give full control of a crypto wallet. The stealers watched page inputs, paste events and page text, and the Phantom impersonator went further: it carried a hidden loader that fetched remotely delivered code from infrastructure under the bonto.io domain and injected it into browser tabs. That design let its operators change what the extension did after installation without submitting a new version for review. Socket also found similarly themed Coinbase and Exodus hosts, but did not locate matching Firefox listings for those brands.

What users should do now

Removing a listing does not automatically protect anyone who already installed one of the fakes, so affected users should treat any wallet used on that browser as potentially exposed and move funds using a clean device and a fresh wallet, rather than reusing the same recovery phrase. As a general rule, wallet extensions should only be installed through links published by the wallet provider itself, and users should check the publisher and add-on details rather than trusting a familiar name and icon. Reports of losses in extension reviews were self-reported and unverified, so this story makes no claim about how much money, if any, was taken.

Sources: GBHackers, Cyber Insider.