A Socket Threat Research investigation says 16 Firefox extensions were built to imitate Rabby and OKX-style crypto-wallet interfaces and capture recovery phrases or private keys during wallet-import flows. The researchers said the extensions attempted to send those secrets to attacker-controlled infrastructure, and that Mozilla had unpublished the identified add-ons by October 5, 2026. [1] Same-day reports published on October 8 repeated the count and described the campaign as a continuation of an earlier Firefox extension operation. [2] [3]
Key points
- Socket identified 16 extensions: four Rabby-style clones and 12 extensions using an OKX-modeled wallet interface. [1]
- The code was designed to collect 12- or 24-word recovery phrases and, in the Rabby clone family, private keys. [1] [3]
- Socket said Mozilla had unpublished the identified extensions by October 5; the fetched Mozilla source provides background on its review process, not an incident-specific confirmation. [1] [4]
- Researchers and security reporters found no verified victim total or confirmed cryptocurrency-loss figure in the material reviewed. [1] [3]
- Anyone who entered a real recovery phrase or private key into an affected extension should treat that wallet as compromised and seek qualified incident-response advice. [1] [3]
What happened
Socket published its technical report on October 7 after examining 16 Firefox add-ons that presented themselves as wallet portals, utilities or browser tools. Four were described as repackaged Rabby Wallet applications, with altered branding and wallet-import screens. Twelve smaller extensions presented an interface modelled on OKX Wallet or a generic “Portal WALLET” product. [1]
The central risk was not simply that the add-ons looked unpolished or requested unusual permissions. Socket found credential-handling code placed along wallet import paths. In the Rabby group, the research team said the code accepted recovery phrases and 64-character hexadecimal private keys. In the OKX-style group, the interface prompted for 12- or 24-word phrases. The report said the data was then sent to Cloudflare Worker endpoints controlled by the operators. [1]
Cybernews and CyberInsider both reported the findings on October 8. Their accounts repeated the 16-extension count, the Rabby/OKX split and the reported Mozilla action. CyberInsider also noted that one sample appeared to contain a packaging defect that prevented the normal theft flow from working as shipped, while still containing explicit collection code. [2] [3]
Why it matters
A browser extension runs close to the activity a user considers private. A wallet extension can also be trusted precisely because it appears inside a familiar browser marketplace. That combination makes a convincing clone dangerous: the user may believe the import screen is part of a legitimate wallet, when it is actually a collection point.
A recovery phrase or private key is not like a password that can simply be reset. Socket and CyberInsider said that changing an extension password would not invalidate a phrase or key that had already been exposed. Their guidance was to create a new wallet from a clean environment, move assets and review related accounts and approvals. [1] [3] Those steps are incident-response guidance from the cited researchers and reporters, not a guarantee that funds can be recovered.
The campaign also shows why a low-permission or “collects no data” label is not enough to establish safety. Socket said the manifests declared no data collection even though the analyzed code handled wallet secrets. Bitdefender’s earlier account of the wider campaign similarly warned that some suspicious add-ons used few permissions and could change behavior through a remote switch. [1] [5]
How the extensions were made to look credible
The four Rabby-style samples retained substantial wallet application material while changing names and selected presentation elements. Socket said the broader set reused code, infrastructure, version histories and campaign markers, which linked the samples to a wider operation. The researchers assessed with high confidence that the October activity continued the crypto-theft campaign they had investigated in August, while cautioning that the evidence did not prove one person controlled every extension. [1]
The earlier campaign was larger but should not be confused with the October count. Bitdefender’s August 24 report summarized Socket’s finding of 77 linked Firefox extensions, of which 40 were confirmed to steal information; the remaining 37 were deceptive sports-score shells whose analyzed builds did not contain confirmed wallet or credential theft. [5] That background explains why a headline about “16 additional extensions” refers to a later cluster, not necessarily 16 added to a single confirmed total.
What remains uncertain
The sources reviewed do not establish how many people installed the 16 add-ons, whether any victim lost cryptocurrency, or the value of any loss. Those figures should not be inferred from the popularity of Rabby or OKX, from download estimates for legitimate products, or from the number of extensions.
The October 5 unpublishing date is reported by Socket and repeated by Cybernews and CyberInsider. Mozilla’s official Add-ons post, published in 2025, confirms that its operations team uses automated risk indicators and human review and has blocked many scam wallets, but it does not independently confirm this specific October 2026 action. [1] [2] [3] [4]
There is also an important distinction between malicious intent and successful execution. Socket described one broken sample whose packaged flow did not load or connect its background handler normally. That does not make the package safe, but it does mean the 16 samples should not be described as having stolen secrets from 16 known victims. [1] [3]
What happens next
The immediate editorial and security priority is to keep the extension list and Mozilla status current. Operators can rotate names, versions, descriptions and identifiers, so a static list is not a substitute for a fresh check of installed Firefox profiles and synchronized devices. Socket said the campaign repeatedly changed presentation while retaining code and infrastructure relationships. [1]
Mozilla’s published guidance is to verify an extension through the legitimate wallet provider’s own website and to use the add-on linked from that official source. It also describes a risk-scoring layer followed by human review for wallet extensions submitted to the Add-ons marketplace. [4] Users should remove unrecognised add-ons, but removal alone cannot undo exposure of a recovery phrase or private key.
Before publication, this report requires a fresh check of Socket’s primary findings, the current Add-ons status and any official Mozilla statement. It should not add a victim count, a loss estimate, or a claim that every listed package successfully exfiltrated data unless new primary evidence supports it.
