Executive Summary
A cluster of malicious Firefox extensions, collectively referred to as the bonto.io campaign, has been identified impersonating prominent cryptocurrency wallets including Phantom, Jupiter, and Bitget. These extensions utilize Unicode homoglyphs and stolen branding to deceive users into installing them. Once installed, the extensions exfiltrate sensitive credentials such as BIP-39 recovery phrases and private keys to subdomains of bonto[.]io.
Technically, the campaign employs various methods of execution. While some extensions bundle the stealer payload directly, the Phantom impersonator uses a reflective loader to fetch a second-stage payload at runtime, allowing the attackers to bypass static review processes. The campaign infrastructure includes multiple brand-specific subdomains and leverages throwaway developer accounts on the Firefox Add-ons (AMO) platform. This activity represents a high-risk threat to cryptocurrency users as it enables direct financial theft by providing attackers with complete control over victim wallets.
The impact is significant for individuals and organizations holding crypto assets. The extensions were found to have manipulated ratings to appear legitimate and possessed capabilities to sweep funds automatically across multiple blockchains including Ethereum, Solana, and Bitcoin.