Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Crypto Wallet Keys
Malicious Firefox extensions impersonated crypto wallets to steal user keys.
Three malicious Firefox extensions disguised as Phantom, Jupiter, and Bitget crypto wallets were found on the Firefox Add-ons store. These extensions aimed to steal users' recovery phrases and private keys. Researchers discovered that the extensions exfiltrated stolen data to subdomains of the bonto[.]io command-and-control domain, with one extension employing a loader to alter its behavior post-Mozilla approval.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Phantom?
Get an email when a new story names Phantom, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers published malicious Firefox extensions that convincingly impersonated legitimate crypto wallet brands—Phantom, Jupiter, and Bitget—to trick users into installing them and surrendering their recovery phrases and private keys. The incident highlights a critical supply chain trust problem: official browser extension stores are not immune to malicious submissions, especially when bad actors use post-approval loader techniques to alter behavior after passing review. Users who relied solely on the Firefox Add-ons store's implied legitimacy had no additional safeguards to catch the deception. This matters enormously in the crypto space because compromised private keys and recovery phrases result in irreversible financial loss with no recourse.
What helps against this
How we list vendors
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — bonto[.]io
- domain — phantom[.]bonto[.]io
- domain — jupiter[.]bonto[.]io
- domain — bitget[.]bonto[.]io
- domain — coinbase[.]bonto[.]io
- domain — exodus[.]bonto[.]io