Rogue Firefox extensions caught silently hijacking crypto keyrings and clipboard data

The researchers over at Socket have shed some light on a network of 77 deceptive Firefox extensions that are specifically built to steal crypto wallet seed phrases, private keyrings, and clipboard data.

According to the report, the operators managed to trick users by disguising malicious code inside what looked like legitimate web tools. This left victims blissfully unaware that their financial data was being sent to hacker-controlled servers.

Many of these extensions pretended to be trusted crypto wallets like Rabby Wallet or OKX. Others hid behind covers like sports score trackers, dark mode tools, or simple note apps. This is the same trick we’ve seen before, with fake VPN extensions pretending to be legitimate VPNs to reroute web traffic.

The interesting thing about this campaign is that instead of trying to crack encrypted files on a device, several extensions modified actual wallet code. So whenever the user created or restored a wallet, the extension grabbed recovery phrases or keyrings in plain text right before local encryption happened.

As Socket researchers noted, “a single successful installation can expose a recovery phrase, private key, or wallet state worth far more than the cost of repeatedly publishing disposable extensions.” That explains why threat actors keep churning out cloned add-ons under slightly tweaked names, knowing even a short lifespan on the Firefox marketplace can net them big payouts.

Other variants targeted user clipboards directly by continuously monitoring copied text and sending it back to a command server. Anything you copied, including passwords, two-factor backup codes, and wallet addresses, could end up exposed. We saw a similar threat recently when a pair of free VPN extensions stole clipboard contents, showing how popular this tactic has become.

To make matters worse, some extensions did not start out evil. Version histories revealed that several add-ons operated for months as simple sports apps before developers pushed updates containing wallet-stealing code.

Again, this is something we’ve seen happen previously too, when dozens of wallpaper extensions faking Google clicks quietly changed behavior after accumulating installs.

Mozilla removed the flagged add-ons after being notified, but catching bad extensions before damage occurs remains tough. That is likely a major reason why Mozilla is working on new security settings to block extensions on sensitive sites like online banking and crypto portals.

Anyone who installed one of these suspicious add-ons should remove it immediately and transfer their funds to a new wallet.

We stand out from the tech-media crowd because we break news stories; we mainly bring you stuff that you won’t find anywhere in the mainstream tech media. Our stories have been picked up by some of the world’s most popular websites and media outlets—more info is available here.