EN PT-BR
← Voltar ao feed
high cryptocurrency finance consumers

Fake Phantom, Jupiter and Bitget Firefox add-ons steal wallet seed phrases and private keys, exfiltrating to bonto[.]io

2 fonte(s) · 2 atualização(ões) · publicado 28/10/2026 10:14 · coletado há 4 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 02/11/2026 00:01; os links antigos trazem para cá.

Fontes: malwarebytes.com ↗ gbhackers.com ↗

Researchers at Socket identified three malicious Firefox add-ons impersonating the Phantom, Jupiter and Bitget crypto wallets. They were built to steal recovery phrases and private keys, which would give the attacker full control of a victim's wallet. Each add-on came from a separate disposable developer account, and stolen data was routed to subdomains of bonto[.]io (gbhackers.com). All three listings have been removed from Firefox Add-ons; Socket published its findings on October 27, 2026 (gbhackers.com), and Malwarebytes reported them on October 29 (malwarebytes.com). Actual wallet losses remain unverified (gbhackers.com). No attribution has been established (gbhackers.com).

Detalhes técnicos

  • Phantom impersonator (add-on ID 3092199): listed as "OFFICIAL PHANTOM WALLET (Firefox Update)". A loader disguised as an analytics component was appended to background/serviceWorker.js. It rebuilt phantom[.]bonto[.]io from character codes and fetched an activation flag and Base64 JavaScript from the /config endpoint. The extension cached the payload and injected it into tabs, so operators could change code without submitting a new version. Socket observed an active 4,029-byte payload (gbhackers.com). The listing requested access to data on all websites and had no privacy policy (malwarebytes.com).
  • The Phantom payload monitored input fields, textareas, paste events and focus changes. It scanned page text for numbered seed phrases and for Ethereum-compatible and Solana private-key patterns, intercepted the injected Solana provider to collect public keys, and sent captured data as JSON (gbhackers.com). It could capture a phrase both when typed during import and when shown on a reveal screen (malwarebytes.com).
  • Jupiter impersonator (ID 3092666, "Built by Jupiter Exchange"): a trojanized background.js exfiltrated mnemonics and keys during wallet imports. A separate hook.js collected inputs and clipboard data and sent them to jupiter[.]bonto[.]io (gbhackers.com).
  • Bitget impersonator (ID 3092059, internally "TabFlow Pro"): it combined page scanning with a background worker that intercepted wallet storage as seeds were decrypted. It redirected tab creation to a local import screen and exfiltrated to bitget[.]bonto[.]io (gbhackers.com).
  • The extensions searched for 12-, 15-, 18- and 24-word recovery phrases plus Ethereum and Solana private keys (malwarebytes.com).
  • All three signed extensions already contained complete stealers in the packages Mozilla reviewed. Remote delivery was supplementary (gbhackers.com).
  • The actors used Unicode homoglyphs, copied icons and marketing text. Socket also found provisioned hosts coinbase[.]bonto[.]io and exodus[.]bonto[.]io, but no matching Firefox listings (gbhackers.com).
  • The Phantom package included Node.js backend code that logged secrets, forwarded them via a Telegram bot and drained assets across nine blockchains using hardcoded payout addresses: Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana and Bitcoin (gbhackers.com, malwarebytes.com). A review server returned inactive configurations, suggesting a planned switch after approval (gbhackers.com).
  • Socket found AI jailbreak instructions in CLAUDE.md files, suggesting attempted manipulation of AI-assisted development or review (gbhackers.com).

Remediação

  • Remove the extension through the three-dot menu in Firefox (malwarebytes.com).
  • Anyone who entered a recovery phrase or private key should create a new wallet on a clean device, move assets immediately and treat the original wallet as compromised (gbhackers.com, malwarebytes.com).
  • Install wallet extensions only from the vendor's official website link, not from store search results (gbhackers.com, malwarebytes.com).
  • Never enter a recovery phrase on a website, and use an up-to-date anti-malware solution (malwarebytes.com).

Relatos divergentes

  • Fund drain: malwarebytes.com says the Phantom variant automatically moved funds to hardcoded payout addresses, and its headline says the add-ons drain funds. gbhackers.com says the Node.js files were bundled artifacts, not evidence of Node.js running in Firefox, and that reported losses are unverified. No confirmed victim losses appear in either source.
  • Listing status: gbhackers.com says the listings were removed before Socket's October 27 publication. malwarebytes.com says they were live during Socket's analysis and have since been removed. These accounts are compatible, and both agree the listings are now gone.

Linha do tempo

  1. malwarebytes.com ↗ · pub. 29/10/2026 11:06 · coletado 01/11 22:21

    Three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget wallets steal recovery phrases and drain funds

    ler a análise desta fonte

    Socket researchers found three malicious Firefox extensions on Firefox Add-ons that impersonated the Phantom, Jupiter and Bitget crypto wallets. Once installed, they stole recovery phrases and private keys, giving the attacker full control of victims' wallets. All three listings were live during Socket's analysis and have since been removed. Malwarebytes reported the findings.

    Technical Details

    • The extensions looked for 12-, 15-, 18- and 24-word recovery phrases, plus Ethereum and Solana private keys.
    • They could read input fields, detect pasted text and scan screens displaying recovery phrases.
    • The Phantom variant could capture a phrase both when typed during import and when displayed on a reveal screen.
    • The Phantom variant's backend logged captured secrets, sent them to a Telegram bot and automatically moved funds to hardcoded payout addresses covering Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana and Bitcoin.
    • The fake Phantom listing requested access to data on all websites and had no privacy policy.
    • Malicious add-on IDs: Phantom impersonator 3092199, Jupiter impersonator 3092666, Bitget impersonator 3092059.

    Remediation

    • Remove the extension via the three-dot menu in Firefox.
    • If a phrase or key was ever entered, create a new wallet on a clean device, move assets immediately and treat the old wallet as compromised.
    • Install wallets only from the vendor's official website link, not store search results.
    • Never enter a recovery phrase on a website; use an up-to-date anti-malware solution.
  2. gbhackers.com ↗ · pub. 28/10/2026 10:14 · coletado 28/10 12:00 primeiro registro

    Fake Phantom, Jupiter and Bitget Firefox Extensions Steal Crypto Wallet Seed Phrases and Private Keys

    ler a análise desta fonte

    Researchers at Socket identified three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget wallets. They were built to steal recovery phrases and private keys. All three listings were removed before Socket published its findings on October 27, 2026. Each came from a separate disposable developer account, and stolen data was routed to subdomains of bonto[.]io. Reported wallet losses remain unverified.

    Technical Details

    • The Phantom impersonator (add-on ID 3092199) was advertised as "OFFICIAL PHANTOM WALLET (Firefox Update)". It carried a loader appended to background/serviceWorker.js, disguised as an analytics component. The loader rebuilt phantom[.]bonto[.]io from character codes and fetched an activation flag and Base64 JavaScript from its /config endpoint. The extension cached the payload and injected it into tabs, so operators could change code without submitting a new version. Socket observed an active 4,029-byte payload.
    • All three signed extensions already contained complete stealers in the packages Mozilla reviewed. Remote delivery was supplementary.
    • The Phantom payload monitored input fields, textareas, paste events and focus changes. It scanned page text for numbered seed phrases and for private-key patterns for Ethereum-compatible networks and Solana. It also intercepted the injected Solana provider to collect public keys and sent captured data as JSON.
    • The Jupiter impersonator (ID 3092666, "Built by Jupiter Exchange") used a trojanized background.js to exfiltrate mnemonics and keys during wallet imports. A separate hook.js collected inputs and clipboard data and sent them to jupiter[.]bonto[.]io.
    • The Bitget impersonator (ID 3092059, internally "TabFlow Pro") combined page scanning with a background worker that intercepted wallet storage as seeds were decrypted. It redirected tab creation to a local import screen and exfiltrated to bitget[.]bonto[.]io.
    • The actors used Unicode homoglyphs, copied icons and marketing text. Socket also found provisioned hosts coinbase[.]bonto[.]io and exodus[.]bonto[.]io, but no matching Firefox listings.
    • The Phantom package included Node.js backend code to log secrets, forward them via Telegram and drain assets across nine blockchains. A review server returned inactive configurations, suggesting a planned post-approval switch. These files were bundled artifacts, not evidence of Node.js running in Firefox.
    • Socket found AI jailbreak instructions in CLAUDE.md files, suggesting attempted manipulation of AI-assisted development or review. No attribution was established.

    Remediation

    • Install wallet extensions only from official vendor websites.
    • Anyone who exposed a recovery phrase or private key should move assets to a newly generated wallet on a clean device and treat the original wallet as compromised.