EN PT-BR
← Voltar ao feed
high cryptocurrency consumers

Three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget wallets steal recovery phrases and drain funds

1 fonte(s) · 1 atualização(ões) · publicado 29/10/2026 11:06 · coletado há 1 hora

Socket researchers found three malicious Firefox extensions on Firefox Add-ons that impersonated the Phantom, Jupiter and Bitget crypto wallets. Once installed, they stole recovery phrases and private keys, giving the attacker full control of victims' wallets. All three listings were live during Socket's analysis and have since been removed. Malwarebytes reported the findings.

Detalhes técnicos

  • The extensions looked for 12-, 15-, 18- and 24-word recovery phrases, plus Ethereum and Solana private keys.
  • They could read input fields, detect pasted text and scan screens displaying recovery phrases.
  • The Phantom variant could capture a phrase both when typed during import and when displayed on a reveal screen.
  • The Phantom variant's backend logged captured secrets, sent them to a Telegram bot and automatically moved funds to hardcoded payout addresses covering Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana and Bitcoin.
  • The fake Phantom listing requested access to data on all websites and had no privacy policy.
  • Malicious add-on IDs: Phantom impersonator 3092199, Jupiter impersonator 3092666, Bitget impersonator 3092059.

Remediação

  • Remove the extension via the three-dot menu in Firefox.
  • If a phrase or key was ever entered, create a new wallet on a clean device, move assets immediately and treat the old wallet as compromised.
  • Install wallets only from the vendor's official website link, not store search results.
  • Never enter a recovery phrase on a website; use an up-to-date anti-malware solution.

Linha do tempo

  1. malwarebytes.com ↗ · pub. 29/10/2026 11:06 · coletado 01/11 22:21 primeiro registro

    Three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget wallets steal recovery phrases and drain funds

    ler a análise desta fonte

    Socket researchers found three malicious Firefox extensions on Firefox Add-ons that impersonated the Phantom, Jupiter and Bitget crypto wallets. Once installed, they stole recovery phrases and private keys, giving the attacker full control of victims' wallets. All three listings were live during Socket's analysis and have since been removed. Malwarebytes reported the findings.

    Technical Details

    • The extensions looked for 12-, 15-, 18- and 24-word recovery phrases, plus Ethereum and Solana private keys.
    • They could read input fields, detect pasted text and scan screens displaying recovery phrases.
    • The Phantom variant could capture a phrase both when typed during import and when displayed on a reveal screen.
    • The Phantom variant's backend logged captured secrets, sent them to a Telegram bot and automatically moved funds to hardcoded payout addresses covering Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana and Bitcoin.
    • The fake Phantom listing requested access to data on all websites and had no privacy policy.
    • Malicious add-on IDs: Phantom impersonator 3092199, Jupiter impersonator 3092666, Bitget impersonator 3092059.

    Remediation

    • Remove the extension via the three-dot menu in Firefox.
    • If a phrase or key was ever entered, create a new wallet on a clean device, move assets immediately and treat the old wallet as compromised.
    • Install wallets only from the vendor's official website link, not store search results.
    • Never enter a recovery phrase on a website; use an up-to-date anti-malware solution.