16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials

This campaign uses 16 malicious Firefox browser extensions masquerading as cryptocurrency wallet portals, desktop utilities, and browser tools to intercept 12- or 24-word mnemonics and private keys during wallet import flows. Four extensions clone Rabby Wallet (with a misspelled name), and twelve impersonate OKX Wallet. Credential theft is facilitated by transmitting stolen data to attacker-controlled Cloudflare Workers endpoints, primarily icy-star-f45c.workers.dev. The campaign reuses code markers and infrastructure linked to crypto-theft operations identified in August 2026. Mozilla has unpublished these extensions to mitigate the threat.

Users who installed and used these malicious extensions risk having their cryptocurrency wallet recovery phrases and private keys stolen, potentially resulting in the loss of all assets in affected wallets. The theft of these credentials allows attackers full access to victims' wallets. The campaign's infrastructure and code reuse indicate ongoing and coordinated crypto-theft operations.

Mozilla has unpublished the malicious extensions from the Firefox Add-ons store, effectively removing them from distribution. Users who entered wallet credentials into these extensions should immediately create new cryptocurrency wallets and transfer their assets to secure them. No further vendor patches are applicable as this is a campaign involving malicious third-party extensions.