Three Firefox add-ons that posed as the Phantom, Jupiter and Bitget crypto wallets were built to steal recovery phrases, along with Ethereum and Solana private keys, from anyone who typed or revealed them. The security firm Socket found the trio while they were still listed on Mozilla’s Firefox Add-ons store, and all three have since been taken down.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
A recovery phrase is a string of 12, 15, 18 or 24 words that restores a wallet and every coin in it. Whoever holds the phrase holds the money, which is why the theft needed no hack of a blockchain, only a convincing imitation of a trusted brand.
Three impersonators on Mozilla’s own store
The finding was reported in a Malwarebytes news post by Pieter Arntz on October 29, which credits Socket’s threat researchers with identifying the extensions. Their listings carried the numeric IDs 3092199 for the Phantom copy, 3092666 for Jupiter and 3092059 for Bitget. CyberInsider, which covered the discovery a day earlier, adds that the Bitget imitation used the internal name TabFlow Pro and that none of the coverage gives install counts for the fakes.
The brands chosen made the lure plausible. Malwarebytes notes that Jupiter’s real extension is offered for Chrome, Brave and Edge, that Bitget’s is a Chrome extension, and that Phantom says its Firefox extension is no longer supported. A Firefox user hunting for any of the three would therefore find nothing official to compare against, and a polished listing on the browser maker’s own store filled the gap.
The scale of the real product explains the target. CyberInsider cites Socket’s figures of about five million Chrome Web Store users and roughly 83,000 daily Firefox users for the genuine Phantom extension, so even a small share of that Firefox audience searching the store would be a worthwhile pool for a thief who needs only a few people to type a phrase.
The Phantom impersonator’s automatic sweep
Socket’s analysis, as relayed by Malwarebytes, found that the extensions could read input fields, detect pasted text and scan screens that display a recovery phrase. The Phantom impersonator was the most aggressive: it captured a phrase when a victim typed it during a wallet import and again when the phrase appeared on a reveal screen. Its backend logged the secrets and forwarded them to a Telegram bot, and it also moved funds automatically to hardcoded payout addresses.
The list of destinations shows how little the operators cared which coins a victim held. The addresses spanned Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana and Bitcoin, nine networks in all. Socket’s published indicators include the domain bonto[.]io and subdomains for Phantom, Jupiter, Bitget, Coinbase and Exodus, which suggests the infrastructure was built to host imitations of more wallets than the three that reached the store.
Two warning signs were visible before any phrase was typed. The fake Phantom listing asked for access to data on all websites, and it offered no privacy policy.
A pattern from earlier this year
The October trio is smaller than a campaign Socket described in August. Graham Cluley of Bitdefender wrote on August 24 that Socket had tied 77 Firefox add-ons to one operation it called the Offside Wallet Theft Factory, of which 40 were confirmed to steal information. Another 37 posed as VPNs, password generators or note-taking tools while running code that tracked sports scores. That earlier operation used a cloud database as a remote switch, so attackers could change an add-on’s behaviour without pushing an update through Mozilla’s review.
Decrypt reported that Mozilla’s signing records put the earlier campaign between March 9 and August 3, 2026, and that several extensions were still live when Socket reported them. It quoted the Socket team saying a recovery phrase entered into one of those add-ons should be treated as permanently compromised. Neither report links the October trio to the August operation, and the sources do not say whether the same group is behind both.
Mozilla’s response is the missing piece in all of this coverage. None of the articles read overnight contains a statement from the company on how the three October listings passed review, how long they were live, or how many people installed them, and Socket’s own post, the original report, could not be loaded to check for those details.
Malwarebytes’ guidance is short. A phrase typed into any website or extension that is not the official wallet app should be treated as stolen. Anyone who entered one into these add-ons should create a new wallet on a clean device and move assets immediately, since the old wallet is compromised for good. Wallets should be installed only from the vendor’s own website link, never from a store search, and a genuine wallet’s support staff will never ask for the phrase.
The unresolved number is the loss. The Malwarebytes post confirms that the Phantom copy was set up to sweep funds automatically, but it gives no figure for victims or stolen value, so how much was actually drained is still unknown.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Hybrids have 15% fewer problems than gas cars, while EVs and plug-in hybrids have about 80% more, Consumer Reports finds
- Regulators cleared the first U.S. small modular reactor, 4 months early
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
