Socket security team dug up another nasty phishing pipeline: out of 77 Firefox extensions, 40 are coming for your wallet. They pose as OKX, Rabby, TronLink — look legit, wait for your recovery phrase, then it's game over. The kicker? 9 of them started as NBA and football score apps, racked up installs and good reviews, then quietly updated into stealers. If you used any of these, your wallet might already be toast.
▪️ 40 confirmed malicious extensions; the other 37 are fake password generators, VPNs, etc. — they do one thing: show sports scores, all hitting the same API.
▪️ 13 are modified Rabby wallets — look normal, but they're shipping your wallet account data to a remote server.
▪️ 5 just steal your browser passwords and clipboard — can't even be bothered to fake a UI.
▪️ 9 went from sports score apps to wallet thieves, using the same Firefox ID, inheriting all the old positive reviews.
▪️ Entering your recovery phrase or private key = permanent leak. Uninstalling the extension won't save you — the data's already gone.
▪️ Socket calls this the 'Offside Wallet Theft Factory' and warns: don't trust any popup asking you to import a wallet.
📊 Malicious extensions:
40📊 Started as sports apps:
9If you're holding a Firefox wallet extension, go check right now if it's from the official source. Don't fall for anything asking for your recovery phrase — real wallets don't do that. Socket says: if you touched any of these, move your funds to a new wallet immediately. No delays. This whole operation shows scammers are getting patient — farm the installs, then harvest. Firefox's review process is basically a joke.
💬 «Anyone who entered a recovery phrase or private key into one of these should treat it as 'permanently compromised' and move funds to a new wallet.» — Socket threat research team
🔮 Firefox review — blind or bought? 9 sports apps turning into wallet stealers shows more effort than most shitcoin rug pulls.
@exverse_chat
