Malicious Firefox Rabby/OKX wallet-clone extensions IOC Sweep

Arnold Chan@slaz

•updated 14 days ago•1•0•4

Detects indicators of compromise associated with malicious Firefox wallet-clone extensions (Rabby/OKX clones) by checking for known file hashes, extension file names in Firefox profile directories, and network connections to known C2 domains and workers.dev subdomains.