Dozens of fake Firefox wallet extensions found stealing cryptocurrency
Fake Firefox extensions target crypto users
Security researchers have identified dozens of fake Firefox browser extensions that pretend to be cryptocurrency wallets. These malicious extensions are designed to steal users' digital assets. A cryptocurrency wallet is a tool that lets people store, send, and receive digital money like Bitcoin or Ethereum.
What security experts found
- Over 100 fake wallet extensions were discovered on Firefox's add-on store.
- The extensions mimic popular crypto wallets to trick users into installing them.
- Once installed, the extensions can steal private keys and seed phrases, giving attackers access to users' funds.
How the malware works
The fake extensions appear legitimate and often use names similar to well-known crypto wallets. When users install them, the extensions request permissions that allow them to access sensitive information. This information can include private keys—secret codes that prove ownership of crypto—and seed phrases, which are backup words used to recover a wallet. With this data, attackers can steal the cryptocurrency stored in the victim's wallet.
What is confirmed
- Dozens of malicious Firefox extensions have been identified.
- These extensions are designed to steal cryptocurrency by collecting private keys and seed phrases.
- The extensions were available on Firefox's official add-on store.
What is still unclear
- The exact number of users affected by these fake extensions is not known.
- It is unclear how long the extensions have been active or how much cryptocurrency has been stolen.
- There is no confirmation on whether Firefox has removed all the malicious extensions from its store.
Why this matters for crypto users
Cryptocurrency transactions are irreversible, meaning stolen funds are often impossible to recover. Users who install fake wallet extensions risk losing all their digital assets. This incident highlights the importance of downloading software only from trusted sources and verifying the authenticity of browser extensions before use.
