16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases

Cybersecurity researchers discovered 16 malicious Mozilla Firefox extensions impersonating legitimate cryptocurrency wallets such as Rabby and OKX. These extensions disguise themselves as wallet portals, desktop utilities, and browser tools. Their underlying code intercepts recovery phrases and private keys during wallet import flows. The stolen secrets are then transmitted to attacker-controlled infrastructure. The campaign targets cryptocurrency users who install what appear to be legitimate browser-based wallet tools. The use of well-known wallet brand names increases the likelihood of user deception. This represents a significant threat to cryptocurrency holders who rely on browser extensions for wallet management.