Phantom

Mentions · 7d3
Mentions · 30d6
All mentions7
First seenSep 17, 2026
Last mentioned3d ago

Timeline

7 articles · newest first

Malicious Firefox extensions impersonate Phantom, Jupiter, and Bitget

Socket says the add-ons stole recovery phrases and private keys; the Phantom copy sent secrets to Telegram and moved funds.

Malwarebytes LabsOct 29, 14:06 UTC · 3d agoMalware 3 sources1

Malicious Firefox extensions impersonated Phantom, Jupiter, and Bitget

Socket says the removed listings sent recovery phrases to bonto.io, and Phantom’s package included a multi-chain drainer.

Cyber Security Newsupdated Oct 29, 14:06 UTC · 3d agofirst Oct 28, 13:17 UTC · 4d agoMalware 3 sources1

Fake Phantom, Jupiter, and Bitget Firefox add-ons stole wallet keys

Socket identified add-on IDs 3092199, 3092666, and 3092059; a live config served a 4,029-byte payload.

GBHackersupdated Oct 29, 14:06 UTC · 3d agofirst Oct 28, 13:14 UTC · 4d agoMalware 3 sources2

INC affiliates left servers open, exposing AI-assisted ransomware operations

SOCRadar says open directories led to six more servers, 8,257 AI messages, and 46 INC encryptor builds.

GBHackersOct 21, 05:57 UTC · 11d agoRansomwareCVE-2026-35616 CVE-2024-57727 CVE-2026-419408 · 4 reads

DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases

DarkSword's Coruna malware uses iOS browser exploits to steal cryptocurrency wallet recovery phrases from iPhones.

Cyber Security NewsOct 8, 15:06 UTC · 24d agoMalwareExploitedCVE-2026-3100113 · 4 reads

Malicious npm Packages Steal Browser Passwords, Discord Tokens and Crypto Wallets.

The MALFEX npm campaign ships Overlord RAT and movinlike to steal browser passwords, Discord tokens, and crypto wallets.

GBHackersupdated Oct 8, 07:51 UTC · 24d agofirst Oct 8, 04:53 UTC · 24d agoMalwareExploited4 sources8 · 5 reads

Fake AI trading agent steals crypto wallet passwords

Fake AI crypto trading agent sites deliver Needle Stealer, which replaces browser wallet extensions to steal wallet passwords, HP reports.

Help Net SecuritySep 17, 08:00 UTC · Sep 17, 2026MalwareExploited2 · 1 read

Related CVEs

by mentions

CVE-2026-3561694%9.8
Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
published Apr 4, 2026Fortinet FortiClient EMSKEVPoC
CVE-2026-4194099%9.3
Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
published Apr 29, 2026WebPros cPanelKEVRansomwarePoC ×9
CVE-2024-5772797%7.5
Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
published Jan 15, 2025SimpleHelp (remote support/remote access software)KEVRansomware
CVE-2026-31001—
published —

Appears with

Bitgetproduct · 3
Jupiterproduct · 3
Firefoxproduct · 3
MetaMaskproduct · 3
Mozillavendor · 2
Socketorganization · 2
Coinbase Walletproduct · 2
Formbookmalware · 1
OpenRouterorganization · 1
Socket.devorganization · 1
Phantom Stealermalware · 1
MALFEXthreat actor · 1
WebKitproduct · 1
Ghost C2malware · 1
Telegram Desktopproduct · 1
Coinbaseproduct · 1

Entities are extracted by the model from each article. First seen Sep 17, 2026, last mentioned 3d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.