16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets

Researchers found 16 malicious Mozilla Firefox extensions masquerading as Rabby and OKX wallet portals. The code intercepts recovery phrases and private keys during wallet import flows and exfiltrates them to attackers.

• 16 Firefox extensions impersonate Rabby, OKX and other wallets
• Code intercepts recovery phrases and private keys during wallet import
• Stolen secrets are sent to attacker-controlled servers