[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5PusSZ6YquaSyMEw1lDqUskx8BIbkU-dB2oylv_zhqI":3},{"article":4,"iocs":53,"watch_terms":73,"solutions":74,"lesson":167},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"f2154dce-19b2-4763-8ec0-5b0e019d1cce","Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Crypto Wallet Keys","malicious-firefox-extensions-impersonate-phantom-jupiter-and-bitget-to-steal-cry-62f117","Three malicious Firefox extensions posed as the Phantom, Jupiter, and Bitget crypto wallets to steal recovery phrases and private keys. Whoever holds these secrets controls the wallet and every coin in it. All three listings were live on the Firefox Add-ons store during the research and have since been removed. The fake add-ons copied the […] The post Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Crypto Wallet Keys appeared first on Cyber Security News.","Three malicious Firefox extensions disguised as Phantom, Jupiter, and Bitget crypto wallets were found on the Firefox Add-ons store. These extensions aimed to steal users' recovery phrases and private keys. Researchers discovered that the extensions exfiltrated stolen data to subdomains of the bonto[.]io command-and-control domain, with one extension employing a loader to alter its behavior post-Mozilla approval.","Malicious Firefox extensions impersonated crypto wallets to steal user keys.","https:\u002F\u002Fcybersecuritynews.com\u002Fmalicious-firefox-extensions-3\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FMalicious-Firefox-Extensions-Impersonate-Phantom-Jupiter-and-Bitget-to-Steal-Crypto-Wallet-Keys.webp","2026-10-28T13:17:06+00:00","2026-10-28T14:00:09.227015+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Phantom","product",{"name":21,"type":19},"Jupiter",{"name":23,"type":19},"Bitget",{"name":25,"type":19},"Rabby",{"name":27,"type":19},"OKX",{"name":29,"type":19},"Coinbase Wallet","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,64,67,70],{"type":55,"value":56,"context":57},"domain","bonto[.]io","Command-and-control domain used by malicious extensions.",{"type":55,"value":59,"context":60},"phantom[.]bonto[.]io","C2 subdomain for the fake Phantom extension.",{"type":55,"value":62,"context":63},"jupiter[.]bonto[.]io","C2 subdomain for the fake Jupiter extension.",{"type":55,"value":65,"context":66},"bitget[.]bonto[.]io","C2 subdomain for the fake Bitget extension.",{"type":55,"value":68,"context":69},"coinbase[.]bonto[.]io","Potential C2 subdomain for a fake Coinbase extension.",{"type":55,"value":71,"context":72},"exodus[.]bonto[.]io","Potential C2 subdomain for a fake Exodus extension.",[18,21,23],{"controls":75,"vendors":160},[76,105,134],{"slug":77,"name":78,"problem":79,"products":80},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":106,"name":107,"problem":108,"products":109},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"slug":135,"name":136,"problem":137,"products":138},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[139,147,153],{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":148,"product_name":149,"url":151,"description":152},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":154,"product_name":157,"url":158,"description":159},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[161],{"slug":162,"name":163,"logo_path":164,"roles":165},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png",[166],"reported_by",{"slug":168,"title":169,"body":170,"framework_refs":171,"framework_notes":179},"fake-crypto-wallet-extensions-on-firefox-store-steal-private-keys","Fake Crypto Wallet Extensions on Firefox Store Steal Private Keys","Attackers published malicious Firefox extensions that convincingly impersonated legitimate crypto wallet brands—Phantom, Jupiter, and Bitget—to trick users into installing them and surrendering their recovery phrases and private keys. The incident highlights a critical supply chain trust problem: official browser extension stores are not immune to malicious submissions, especially when bad actors use post-approval loader techniques to alter behavior after passing review. Users who relied solely on the Firefox Add-ons store's implied legitimacy had no additional safeguards to catch the deception. This matters enormously in the crypto space because compromised private keys and recovery phrases result in irreversible financial loss with no recourse.",[172,173,174,175,176,177,178],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":180,"MITRE ATT&CK T1566: Phishing":181,"NIST SP 800-53 SI-2: Flaw Remediation":182,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":183,"CIS Control 14: Security Awareness and Skills Training":184,"CIS Control 2: Inventory and Control of Software Assets":185,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":186},"NIS2 mandates supply chain security measures including assessment of the security of software components, which would require organizations to vet browser extensions before permitting their use in operational environments.","Disguising malicious extensions as trusted wallet brands is a social-engineering lure analogous to phishing, where impersonation of a trusted entity tricks victims into surrendering credentials or installing malware.","Store-level vetting processes failed to detect the loader-based evasion technique, pointing to the need for continuous integrity monitoring of approved software, not just one-time review at submission.","Organizations must ensure personnel have the competence to recognize supply chain software risks, including the danger of counterfeit browser extensions targeting high-value assets like crypto wallets.","Users trained to verify software authenticity through official vendor channels rather than trusting store listings alone would be far less likely to install impersonating extensions.","Maintaining an approved inventory of authorized browser extensions would have prevented unapproved, malicious extensions from being installed on managed systems.","Protecting cryptographic keys and recovery phrases requires strict access controls and user practices that prevent unauthorized exfiltration, which these malicious extensions bypassed entirely through user deception."]