Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets

Malicious Firefox extensions impersonating popular cryptocurrency wallets Phantom, Jupiter, and Bitget have been discovered stealing users' recovery phrases and private keys. These extensions use Unicode homoglyphs to mimic legitimate wallet names and exfiltrate credentials to brand-named subdomains of bonto.io. The Phantom impersonator uses a two-stage loader to fetch additional malicious payloads at runtime. The campaign also prepares infrastructure for targeting Coinbase and Exodus wallets. Stolen secrets allow attackers full control over victims' cryptocurrency wallets and assets.

• Malicious Chrome and Firefox Extensions Steal Crypto Traders' Session and Wallet DataMalware2026-09-10
• 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet CredentialsCampaign2026-10-08
• 77 Firefox Extensions Linked to Crypto Wallet and Credential TheftCampaign2026-08-20