EN PT-BR
← Voltar ao feed
high cryptocurrency finance

Fake Phantom, Jupiter and Bitget Firefox Extensions Steal Crypto Wallet Seed Phrases and Private Keys

1 fonte(s) · 1 atualização(ões) · publicado 28/10/2026 10:14 · coletado há 4 dias

Researchers at Socket identified three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget wallets. They were built to steal recovery phrases and private keys. All three listings were removed before Socket published its findings on October 27, 2026. Each came from a separate disposable developer account, and stolen data was routed to subdomains of bonto[.]io. Reported wallet losses remain unverified.

Detalhes técnicos

  • The Phantom impersonator (add-on ID 3092199) was advertised as "OFFICIAL PHANTOM WALLET (Firefox Update)". It carried a loader appended to background/serviceWorker.js, disguised as an analytics component. The loader rebuilt phantom[.]bonto[.]io from character codes and fetched an activation flag and Base64 JavaScript from its /config endpoint. The extension cached the payload and injected it into tabs, so operators could change code without submitting a new version. Socket observed an active 4,029-byte payload.
  • All three signed extensions already contained complete stealers in the packages Mozilla reviewed. Remote delivery was supplementary.
  • The Phantom payload monitored input fields, textareas, paste events and focus changes. It scanned page text for numbered seed phrases and for private-key patterns for Ethereum-compatible networks and Solana. It also intercepted the injected Solana provider to collect public keys and sent captured data as JSON.
  • The Jupiter impersonator (ID 3092666, "Built by Jupiter Exchange") used a trojanized background.js to exfiltrate mnemonics and keys during wallet imports. A separate hook.js collected inputs and clipboard data and sent them to jupiter[.]bonto[.]io.
  • The Bitget impersonator (ID 3092059, internally "TabFlow Pro") combined page scanning with a background worker that intercepted wallet storage as seeds were decrypted. It redirected tab creation to a local import screen and exfiltrated to bitget[.]bonto[.]io.
  • The actors used Unicode homoglyphs, copied icons and marketing text. Socket also found provisioned hosts coinbase[.]bonto[.]io and exodus[.]bonto[.]io, but no matching Firefox listings.
  • The Phantom package included Node.js backend code to log secrets, forward them via Telegram and drain assets across nine blockchains. A review server returned inactive configurations, suggesting a planned post-approval switch. These files were bundled artifacts, not evidence of Node.js running in Firefox.
  • Socket found AI jailbreak instructions in CLAUDE.md files, suggesting attempted manipulation of AI-assisted development or review. No attribution was established.

Remediação

  • Install wallet extensions only from official vendor websites.
  • Anyone who exposed a recovery phrase or private key should move assets to a newly generated wallet on a clean device and treat the original wallet as compromised.

Linha do tempo

  1. gbhackers.com ↗ · pub. 28/10/2026 10:14 · coletado 28/10 12:00 primeiro registro

    Fake Phantom, Jupiter and Bitget Firefox Extensions Steal Crypto Wallet Seed Phrases and Private Keys

    ler a análise desta fonte

    Researchers at Socket identified three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget wallets. They were built to steal recovery phrases and private keys. All three listings were removed before Socket published its findings on October 27, 2026. Each came from a separate disposable developer account, and stolen data was routed to subdomains of bonto[.]io. Reported wallet losses remain unverified.

    Technical Details

    • The Phantom impersonator (add-on ID 3092199) was advertised as "OFFICIAL PHANTOM WALLET (Firefox Update)". It carried a loader appended to background/serviceWorker.js, disguised as an analytics component. The loader rebuilt phantom[.]bonto[.]io from character codes and fetched an activation flag and Base64 JavaScript from its /config endpoint. The extension cached the payload and injected it into tabs, so operators could change code without submitting a new version. Socket observed an active 4,029-byte payload.
    • All three signed extensions already contained complete stealers in the packages Mozilla reviewed. Remote delivery was supplementary.
    • The Phantom payload monitored input fields, textareas, paste events and focus changes. It scanned page text for numbered seed phrases and for private-key patterns for Ethereum-compatible networks and Solana. It also intercepted the injected Solana provider to collect public keys and sent captured data as JSON.
    • The Jupiter impersonator (ID 3092666, "Built by Jupiter Exchange") used a trojanized background.js to exfiltrate mnemonics and keys during wallet imports. A separate hook.js collected inputs and clipboard data and sent them to jupiter[.]bonto[.]io.
    • The Bitget impersonator (ID 3092059, internally "TabFlow Pro") combined page scanning with a background worker that intercepted wallet storage as seeds were decrypted. It redirected tab creation to a local import screen and exfiltrated to bitget[.]bonto[.]io.
    • The actors used Unicode homoglyphs, copied icons and marketing text. Socket also found provisioned hosts coinbase[.]bonto[.]io and exodus[.]bonto[.]io, but no matching Firefox listings.
    • The Phantom package included Node.js backend code to log secrets, forward them via Telegram and drain assets across nine blockchains. A review server returned inactive configurations, suggesting a planned post-approval switch. These files were bundled artifacts, not evidence of Node.js running in Firefox.
    • Socket found AI jailbreak instructions in CLAUDE.md files, suggesting attempted manipulation of AI-assisted development or review. No attribution was established.

    Remediation

    • Install wallet extensions only from official vendor websites.
    • Anyone who exposed a recovery phrase or private key should move assets to a newly generated wallet on a clean device and treat the original wallet as compromised.