16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
Sixteen malicious Firefox extensions impersonating Rabby and OKX wallets stole recovery phrases via Cloudflare Workers.
Socket identified 16 malicious Firefox extensions, four cloning Rabby Wallet and the rest OKX Wallet, that intercept recovery phrases and private keys during wallet import and send them to a Cloudflare Workers domain. Researchers link the activity to an August 2026 wave that rotates names and extension IDs while reusing the same interfaces and infrastructure. All 16 add-ons had been removed by October 5, 2026. The report also describes separate Firefox, Chrome, and Edge clusters that steal Google session cookies, redirect users to wallet-phishing pages, proxy traffic, and harvest AI chatbot conversations.
64