Malicious Firefox extensions impersonate Phantom, Jupiter, and Bitget
Original title: Malicious Firefox extensions impersonate popular crypto wallets
Socket says the add-ons stole recovery phrases and private keys; the Phantom copy sent secrets to Telegram and moved funds.
Socket found three Firefox Add-ons posing as the Phantom, Jupiter, and Bitget crypto wallets. After installation they collected recovery phrases and Ethereum and Solana private keys by reading inputs, pasted text, and on-screen phrases. The Phantom copy logged secrets, sent them to a Telegram bot, and moved funds to hardcoded payout addresses. Socket says the listings were live during analysis and have since been removed.
- Firefox add-on IDs were 3092199, 3092666, and 3092059.
- The extensions sought 12-, 15-, 18-, and 24-word recovery phrases.
- Payout chains included Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana, and Bitcoin.
- Genuine Phantom says its Firefox extension is no longer supported.
- Related infrastructure used bonto.io subdomains, including coinbase and exodus names.
Impact: theft of wallet recovery phrases, private keys, and funds
- 1.Remove Firefox add-ons 3092199, 3092666, and 3092059 if installed.
- 2.If a phrase or key was entered, move assets to a new wallet on a clean device.
- 3.Install wallets only from the vendor's official site, not store search results.
- Organizations
- Socket
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bitget.bonto.io | mains: bonto[.]io phantom[.]bonto[.]io jupiter[.]bonto[.]io bitget[.]bonto[.]io coinbase[.]bonto[.]io exodus[.]bonto[.]io IP addresses: |
| domain | bonto.io | 3092666 Bitget impersonator: add-on ID 3092059 Subdomains: bonto[.]io phantom[.]bonto[.]io jupiter[.]bonto[.]io bitget[.]bonto[ |
| domain | coinbase.bonto.io | antom[.]bonto[.]io jupiter[.]bonto[.]io bitget[.]bonto[.]io coinbase[.]bonto[.]io exodus[.]bonto[.]io IP addresses: 104.21.34[.]69 172.67 |
| domain | exodus.bonto.io | iter[.]bonto[.]io bitget[.]bonto[.]io coinbase[.]bonto[.]io exodus[.]bonto[.]io IP addresses: 104.21.34[.]69 172.67.155[.]198 From repo |
| domain | jupiter.bonto.io | d-on ID 3092059 Subdomains: bonto[.]io phantom[.]bonto[.]io jupiter[.]bonto[.]io bitget[.]bonto[.]io coinbase[.]bonto[.]io exodus[.]bont |
| domain | phantom.bonto.io | tget impersonator: add-on ID 3092059 Subdomains: bonto[.]io phantom[.]bonto[.]io jupiter[.]bonto[.]io bitget[.]bonto[.]io coinbase[.]bon |
| ipv4 | 104.21.34.69 | ]io coinbase[.]bonto[.]io exodus[.]bonto[.]io IP addresses: 104.21.34[.]69 172.67.155[.]198 From reporting threats to removing them. |
| ipv4 | 172.67.155.198 | bonto[.]io exodus[.]bonto[.]io IP addresses: 104.21.34[.]69 172.67.155[.]198 From reporting threats to removing them. Cybersecurity ri |
From the original article
2 min read at malwarebytes.com
Fake Firefox extensions posing as Phantom, Jupiter, and Bitget targeted users to steal crypto wallet recovery phrases and private keys.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.