Executive Summary
Socket Threat Research has identified a coordinated campaign involving 16 malicious Firefox extensions targeting cryptocurrency users. These extensions impersonate popular wallet applications, specifically Rabby Wallet and OKX Wallet, to steal sensitive mnemonic recovery phrases and private keys. The malicious add-ons were available on the Mozilla Firefox Add-ons store until they were removed on October 5, 2026.
The attack involves two distinct families: clones of Rabby Wallet (branded as 'Raabby WaIIet') and clones of OKX Wallet (branded as 'Portal WALLET'). The malware hooks into wallet import and creation flows, capturing raw secrets and exfiltrating them to attacker-controlled Cloudflare Workers infrastructure. This campaign is an evolution of a similar cluster of crypto-theft extensions identified in August 2026, demonstrating continued reuse of TTPs and network infrastructure.
Impact is high for users who entered credentials into these extensions, as the stolen data grants full control over their digital assets. Organizations and individuals must immediately identify and remove these extensions and migrate assets from any compromised wallets to new environments.