Source: socket.dev
Socket's Threat Research Team discovered a cluster of malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget crypto wallets to steal recovery phrases and private keys. The extensions use Unicode homoglyphs to mimic legitimate wallet names and route stolen data to brand-named subdomains of a single C2 apex, bonto[.]io. The Phantom impersonator uses a two-stage approach: a loader fetches a remote payload at runtime, allowing operators to swap the stealer after Mozilla's review. All three extensions also bundle complete stealers in their signed packages. The Phantom package additionally contains a Node.js drainer backend that forwards stolen secrets via Telegram and auto-sweeps funds to hardcoded wallet addresses across multiple blockchains. Infrastructure provisioned for Coinbase and Exodus subdomains suggests the campaign is broader than the three confirmed listings. Rating manipulation was observed on the Phantom listing to suppress negative reviews from victims reporting fund losses. All three listings have been removed from Firefox Add-ons as of publication.
