Fake Firefox Crypto Wallet Extensions Stole Recovery Phrases

Three malicious Firefox extensions posed as popular cryptocurrency wallets and searched for the secrets needed to control users’ funds. The listings have been removed, but anyone who installed an extension claiming to be Phantom, Jupiter or Bitget should check Firefox and secure the affected wallet now.

What happened

Security researchers at Socket found fake Firefox add-ons impersonating Phantom, Jupiter and Bitget, according to Malwarebytes. The extensions could capture wallet recovery phrases and private keys by reading typed or pasted text and scanning pages where recovery phrases appeared.

The malicious add-ons looked for recovery phrases containing 12, 15, 18 or 24 words. They also searched for private keys associated with Ethereum and Solana wallets. A recovery phrase or private key gives its holder control of the wallet, so an attacker who steals one can move the wallet’s assets.

Malwarebytes reported that the fake Phantom extension sent stolen information to a Telegram bot and could automatically transfer funds to preset addresses. Its supported targets included wallets using Bitcoin, Ethereum, Solana and several other blockchain networks.

Socket said all three malicious listings were available through Firefox Add-ons during its investigation. They have since been removed.

Who is affected

The warning applies to Firefox users who installed an extension presented as Phantom, Jupiter or Bitget. It is especially urgent for anyone who typed, pasted or displayed a recovery phrase or private key while one of those extensions was installed.

The legitimate services’ stated browser support provides an important warning sign. According to Malwarebytes, Phantom says it no longer supports a Firefox extension. Jupiter lists extensions for Chrome, Brave and Edge, while Bitget offers its extension for Chrome.

A recovery phrase is not an ordinary password. It is a backup of the keys that provide access to a crypto wallet, and anyone who obtains it may control the funds. Wallet support staff will not ask users to reveal it.

What to do now

1. Check Firefox extensions. Open Firefox’s menu, select Add-ons and themes, and then open Extensions. Look for anything claiming to be Phantom, Jupiter or Bitget.

2. Remove a suspected extension. Use the extension’s menu on the Extensions page to remove it. Do not open it again or enter any wallet information into it.

3. Verify browser support at the wallet’s official website. Do not rely on an add-on’s name, logo or store description. The reported browser support does not include Firefox for any of the three wallets named in this campaign.

4. Treat any entered recovery phrase or private key as exposed. Go directly to the wallet provider’s official website and follow its security or recovery instructions. Never give the phrase to someone who contacts you or claims to offer support.

5. Review the wallet through its official app. Check for transfers you do not recognize. Malwarebytes reported that the fake Phantom extension could send captured secrets to attackers and automatically move funds.