16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
Summary: Researchers at Socket found 16 malicious Mozilla Firefox extensions that pose as wallet portals and browser tools and intercept recovery phrases and private keys during wallet import flows, sending them to attacker-controlled Cloudflare Workers. Four are clones of Rabby Wallet and the rest target OKX Wallet, all but one contacting the "*.icy-star-f45c.workers[.]dev" domain, and all were removed as of October 5, 2026.
Bottom line: The actors rotated package names, versions, extension IDs, and descriptions while reusing the same wallet interfaces and network infrastructure, which ties this to an earlier wave documented in August 2026 - so removal of these 16 add-ons does not close the campaign. Anyone who entered a real recovery phrase into these fake interfaces should assume compromise and move assets from a new wallet built on a clean system.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026