Fake Phantom, Jupiter, and Bitget Firefox add-ons stole wallet keys
Original title: Hackers Use Fake Phantom, Jupiter, and Bitget Firefox Extensions to Target Cryptocurrency Wallets
Socket identified add-on IDs 3092199, 3092666, and 3092059; a live config served a 4,029-byte payload.
Socket found three Firefox extensions that impersonated Phantom, Jupiter, and Bitget and stole recovery phrases and private keys through bonto.io. All three listings were removed before Socket published on October 27, 2026. Each signed package already contained a working stealer, while Phantom could also fetch remote JavaScript. Reported wallet losses remained unverified.
Unconfirmed: Socket says reported wallet losses remained unverified and found no Coinbase or Exodus listings.
- Add-on IDs were 3092199 for Phantom, 3092666 for Jupiter, and 3092059 for Bitget.
- Socket observed an active configuration serving a 4,029-byte Phantom payload.
- Jupiter sent secrets to jupiter.bonto.io and Bitget sent them to bitget.bonto.io.
- Phantom’s bundled Node.js files logged secrets, used Telegram, and targeted nine networks.
Impact: Stolen wallet mnemonics, private keys, and public keys
- 1.Install wallet extensions only through official vendor websites.
- 2.Transfer assets to a newly generated wallet on a clean device if a secret was exposed.
- 3.Treat the original wallet as compromised after any exposure.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bitget.bonto.io | port screen. Both components transmitted stolen material to bitget[.]bonto[.]io. Socket’s technical investigation identified additional |
| domain | bonto.io | with stolen information routed through infrastructure under bonto[.]io. All three listings were removed before Socket published |
| domain | coinbase.bonto.io | al investigation identified additional provisioned hosts at coinbase[.]bonto[.]io and exodus[.]bonto[.]io, although corresponding Firefox |
| domain | exodus.bonto.io | d additional provisioned hosts at coinbase[.]bonto[.]io and exodus[.]bonto[.]io, although corresponding Firefox listings were not locat |
| domain | jupiter.bonto.io | ts from page inputs and clipboard activity, sending data to jupiter[.]bonto[.]io. Bitget’s impersonator, ID 3092059, combined page scann |
| domain | phantom.bonto.io | guised as an optional analytics component, it reconstructed phantom[.]bonto[.]io from character codes and requested instructions from it |
From the original article
3 min read at gbhackers.com
Three malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget to steal cryptocurrency wallet recovery phrases and private keys. The campaign combines deceptive branding, bundled credential stealers, and remotely delivered JavaScript, with stolen information routed through infrastructure under bonto[.] io.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.