Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets

Socket’s Threat Research Team reported a cluster of malicious Firefox extensions that impersonated Phantom, Jupiter, and Bitget cryptocurrency wallets using copied branding, Unicode lookalike names, and in one case manipulated ratings to appear legitimate. The extensions stole recovery phrases and private keys through input monitoring, clipboard and page-content scanning, and wallet-provider hooks, then sent the data to brand-themed subdomains under bonto[.]io; the Phantom impersonator additionally downloaded and executed a remotely controlled second-stage payload after installation, allowing its operators to alter behavior after Mozilla review. All packages also contained embedded stealers, while the Phantom package reportedly included backend code designed to forward secrets through Telegram and automatically transfer assets to hardcoded cryptocurrency addresses. Researchers identified additional bonto[.]io infrastructure suggesting potential targeting of Coinbase Wallet and Exodus, as well as separate disposable Mozilla Add-ons developer accounts used to publish the confirmed listings. The extensions were removed from Firefox Add-ons by publication, and the report advises users to obtain wallet extensions only through official vendor links, immediately migrate funds if secrets were exposed, and block or investigate bonto[.]io-related network activity.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.