Key takeaways
- Socket identified 16 malicious Firefox extensions cloning Rabby and OKX wallet interfaces: four repackaged Rabby clones, twelve resembling OKX.
- They behaved like real wallets until the user imported an existing wallet, at which point hidden code copied the recovery phrase or private key to an attacker-controlled server on Cloudflare Workers.
- Mozilla had removed them by 5 October 2026; Socket published on 7 October. Install totals and losses remain unquantified.
- Every one of the manifests declared to Firefox that the add-on collected no data.
- Removal does not undo exposure. A seed phrase that was typed into one of these is permanently compromised, and changing a password does nothing about it.
Security firm Socket documented sixteen malicious Firefox extensions that cloned the Rabby and OKX wallet interfaces in order to capture recovery phrases and private keys. Four were repackaged clones of Rabby; twelve closely resembled OKX. Mozilla had removed them by 5 October 2026 and Socket published on the 7th.
The headline most people will read is that the extensions are gone. That is true, and for anyone who already used one it is close to irrelevant, which is the part worth spending a thousand words on.
The trigger was the one moment the secret exists
These were not broken or obviously fake. They worked. You could install one and use it and nothing would appear wrong.
The malicious code waited for a specific action: importing an existing wallet. At that moment — and only then — hidden code copied the recovery phrase or private key and sent it to a server the attacker controlled, hosted on Cloudflare Workers.
That targeting is precise and worth understanding. A seed phrase normally exists as twelve or twenty-four words on paper, or in your head, or in a hardware device that never reveals it. There is essentially one routine moment in its life when it exists as plaintext in software: when you type it in to restore a wallet.
The attack does nothing at all except wait for that moment. Creating a fresh wallet inside the extension would not have exposed anything, because there would have been nothing to copy.
Why removal is not the fix
Here is the asymmetry people miss, and it is not intuitive.
When a malicious app is removed from a store, the usual mental model is that the threat has been neutralised. For most malware that is roughly right — remove it, run a scan, change your password, move on.
A seed phrase does not work that way. It is not a credential you can rotate. It is the wallet. Anyone holding those words can reconstruct every key, on any device, at any time, for as long as the wallet exists. There is no session to revoke, no password reset, no "log out all devices".
So removing the extension protects the next person. It does nothing whatsoever for the previous one. Guidance circulating with this research is blunt about the consequence: if you entered a real recovery phrase into one of these, treat that wallet as compromised — create a new one on a clean device, move everything, and revoke token approvals tied to the exposed address.
Changing the extension's password is not a remediation. The password protected the vault; the words are the vault.
The disclosure field that nobody checks
One detail in Socket's findings deserves far more attention than it is getting.
Every one of these extensions declared in its manifest that it collected no data.
Firefox add-ons carry a data-practices declaration, surfaced to users as a statement about what the extension does with their information. It is self-asserted. Nothing verifies it against the code. An extension whose entire purpose was exfiltrating seed phrases filled in the same field, with the same answer, as a genuinely privacy-respecting one.
That is not a Mozilla-specific flaw — the same structure exists across every major app and extension store. But it is a precise illustration of a general failure: a declaration that costs nothing to make and is never checked conveys no information at all, while looking exactly like information.
If you have been using that field as reassurance, it was never telling you anything.
How to tell a clone from the real thing
Visual inspection does not work here. These were repackaged clones — the interface was the real interface, because it was copied from it. Screenshots, icon, layout and flow all looked correct, because they were.
Three things that do help:
- Install only from a link on the project's own site. Not from search results inside the store, and not from a link in a message. Go to the official domain first, follow its link out. This single habit defeats almost all of this category, because it removes your judgement about which listing is genuine from the process entirely.
- Treat the publisher and install count as weak signals, not proof. Both can be faked or inflated, and a convincing clone usually has a plausible-looking publisher name.
- Never type an existing seed phrase into software you installed in the last few minutes. If you must import, do it into a wallet you have been running for a while, or better, use a hardware device where the phrase never reaches the computer at all.
That last point connects to something we covered recently. When Ledger confirmed a hardware implant, the reason it was serious was the same reason hardware wallets are usually safer: they are built so the seed never exists on a general-purpose computer. Here, the attack worked precisely because the seed had to be typed into one.
What is not yet known
Two honest gaps.
Install totals and financial losses remain unquantified. Nobody has published how many people installed these or how much was taken. It could be very little. An absence of reported losses is not evidence of an absence of losses, and it is also not evidence of large ones.
The scope is contested. Socket links this to an earlier August campaign with high confidence. Separate reporting describes a broader March-to-August wave of 77 extensions, 40 of them wallet stealers, which appears to be a different and earlier campaign rather than the same one. I have seen those numbers merged in coverage this week, and they should not be — a reader who comes away believing 77 extensions were pulled in October has been given a worse picture than the one the research supports, in both directions.
The one habit
If you take a single thing from this: the moment you type a recovery phrase is the moment your wallet is at maximum risk, and almost every seed-phrase theft in this category depends on engineering a reason for you to do it.
Fake support asking you to "verify" or "restore". A wallet that appears broken and needs re-importing. A migration to a "new version". A clone that works perfectly until the moment you import.
Treat any prompt to enter those words as the highest-alert event in your week, regardless of how routine it looks or how legitimate the thing asking appears. The words are not a password. They are the account, permanently, and the only reliable protection is that they are typed very rarely and only somewhere you chose deliberately rather than somewhere that asked.
Frequently asked questions
The extensions were removed. Am I safe now?
If you never entered an existing recovery phrase into one, you are very likely fine - the malicious code specifically targeted the import action. If you did enter one, removal changes nothing for you. A seed phrase cannot be rotated like a password; anyone holding it can reconstruct your keys indefinitely.
What should I do if I think I entered my phrase into one of these?
Guidance published with the research is to treat that wallet as compromised: create a new wallet on a clean device, move all assets to it, and revoke token approvals tied to the exposed address. Changing the extension password does not help, because the password protected the vault while the words are the vault.
How did they get into the Firefox store at all?
They were repackaged clones using the real interfaces, which makes visual review ineffective, and they behaved normally until the import action - so casual testing would not surface anything. Every manifest also declared that the add-on collected no data, a self-asserted field that nothing verifies against the code.
Does this mean Firefox is less safe than other browsers?
No. Self-asserted data declarations and clone listings are a structural feature of every major app and extension store, not a Mozilla-specific flaw. Mozilla removed these by 5 October.
How do I install a wallet extension safely?
Start at the project's own website and follow its link into the store, rather than searching within the store or following a link from a message. That removes your judgement about which listing is genuine from the process, which is where this category of attack does its work.
How many people were affected?
Unknown. Install totals and financial losses have not been quantified. Note also that a separate March-to-August campaign of 77 extensions, 40 of them wallet stealers, is being merged into coverage of this one in places - it appears to be an earlier, different wave.
Sources
Every figure and quote above traces to one of these. Checked on publication day.
- socket.dev — 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials - Socket
- thedefiant.io — Socket Finds 16 Fake Rabby and OKX Wallet Extensions on Firefox - The Defiant
- cybersecuritynews.com — Hackers Use Fake Firefox Wallet Extensions to Steal Crypto Recovery Phrases - Cyber Security News
- securityonline.info — 16 Fake Rabby and OKX Firefox Extensions Stole Crypto Wallet Recovery Phrases - Security Online
- vardaan-cyber.com — Fake Crypto Wallets in Firefox: How 16 Malicious Extensions Stole Recovery Phrases - Vardaan Cyber
Deepmoni Das, Editor
I read the primary filings, exchange notices and post-mortems behind each story and write up what they actually say — with every source linked so you can check me. I am not a trader and I do not hold positions in anything covered here. Research and drafting are AI-assisted; the sourcing, the edits and the mistakes are mine.
Not financial advice. Crypto assets are volatile and unregulated in many jurisdictions. In India, gains are taxed at 30% with 1% TDS on transfers. Do your own research and never invest money you cannot afford to lose.
Editorial note: Crypto Shakti uses an AI-assisted research and drafting workflow. Every article is grounded in the linked primary sources and live market data captured at publication time.