Security Firm: 40 Malicious Firefox Crypto Wallet Extensions Steal Seed Phrases

August 25 news, according to Decrypt, security firm Socket has uncovered a malicious extension campaign targeting Firefox users, linking 77 extension identities through shared code, infrastructure, and release patterns, of which 40 have been confirmed as malicious. These extensions primarily impersonate Web3 products such as OKX, Rabby Wallet, and TronLink, stealing user-entered seed phrases, private keys, account data, saved credentials, or clipboard contents via fake wallet interfaces or tampered real wallet code. Socket stated that another 37 extensions masquerade as tools like password generators, VPNs, and dark mode utilities, but actually run sports score applications; among them, 9 malicious extensions were initially released as sports score tools, then replaced with wallet-stealing code via updates.