Warning: Dozens of fake wallet plugins flood Firefox Store to steal cryptocurrency

PANews reported on July 2 that according to BleepingComputer, the security company Koi found more than 40 fake crypto wallet extensions in the official Firefox browser plug-in store, impersonating mainstream wallets such as MetaMask and Coinbase Wallet. These malicious plug-ins implant event monitoring codes to steal input content of more than 30 characters (mainly for mnemonics) and send the data back to the attacker's server.

Investigations show that the phishing campaign has been going on since at least April 2025, and the group behind it is suspected to be a Russian hacker group. The malicious plug-in not only steals the genuine brand logo, but also increases its credibility through a large number of fake five-star reviews. Although some users have exposed the scam through one-star reviews, the download volume of most fake plug-ins is still significantly abnormal. Although Firefox has an automated risk detection system, a large number of malicious plug-ins reported as of press time have not been removed. Researchers remind users to check the developer information and the authenticity of the download volume when installing wallet extensions.