Source: socket.dev
Socket Threat Research identified a coordinated campaign of 16 malicious Firefox extensions targeting cryptocurrency wallet users, specifically impersonating Rabby Wallet and OKX Wallet. The extensions intercept recovery phrases and private keys during wallet import flows and exfiltrate them to attacker-controlled Cloudflare Workers. Four extensions clone Rabby Wallet under the misspelled brand 'Raabby WaIIet', while twelve clone OKX Wallet under a 'Portal WALLET' facade. All extensions share a common campaign marker 'EQOx7EIPZSNi' and primarily use the same Cloudflare Worker infrastructure at 'icy-star-f45c.workers.dev'. The campaign uses multiple exfiltration transports including GET requests, POST JSON, sendBeacon, and image-pixel fallbacks. Mozilla unpublished all 16 extensions as of October 5th. This campaign is assessed with high confidence to be a continuation of a crypto-theft extension campaign Socket previously identified in August 2026. Affected users should treat exposed wallets as fully compromised and immediately migrate assets to new wallets.
