Malicious Firefox extensions impersonated Phantom, Jupiter, and Bitget
Original title: Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Crypto Wallet Keys
Socket says the removed listings sent recovery phrases to bonto.io, and Phantom’s package included a multi-chain drainer.
Socket.dev reported on October 27, 2026, that three Firefox add-ons copied Phantom, Jupiter, and Bitget branding to steal wallet recovery phrases and private keys. The listings were live during research and have since been removed. Stolen data went to subdomains of bonto.io; the Phantom package also contained a loader and a Node.js drainer that forwarded secrets to Telegram and fixed payout addresses.
Unconfirmed: User claims of lost funds are unverified, and no Coinbase or Exodus store listings were found.
- Socket published findings on October 27, 2026, after the three listings were removed.
- Phantom fetched a Base64 stealer from phantom.bonto.io and could change it after review.
- Reviews rose from 275 to 546 in about two days; fund-loss claims are unverified.
- Coinbase and Exodus subdomains existed, but Socket found no matching store listings.
Impact: Stolen wallet recovery phrases and private keys
- 1.Install wallet extensions only from the maker’s official website, not store search.
- 2.If a phrase or key was entered, move funds to a new wallet on a clean device.
- 3.Block the bonto.io domain and its subdomains.
- Vendors
- Mozilla
- Organizations
- Socket.dev
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bitget.bonto.io | ent the recovery phrase straight to jupiter[.]bonto[.]io or bitget[.]bonto[.]io. The Jupiter copy also asked for access to Trezor Conne |
| domain | bonto.io | en secrets to subdomains of one command-and-control domain, bonto[.]io. The Phantom copy also carried a hidden loader that could |
| domain | coinbase.bonto.io | des the real host. Socket also found working subdomains for coinbase[.]bonto[.]io and exodus[.]bonto[.]io. That suggests the group planne |
| domain | exodus.bonto.io | also found working subdomains for coinbase[.]bonto[.]io and exodus[.]bonto[.]io. That suggests the group planned to impersonate Coinbas |
| domain | jupiter.bonto.io | ler in the package and sent the recovery phrase straight to jupiter[.]bonto[.]io or bitget[.]bonto[.]io. The Jupiter copy also asked for |
| domain | phantom.bonto.io | inside a list of numbers, then fetched a settings file from phantom[.]bonto[.]io. That file told the extension whether to run and carrie |
| domain | socket.dev | ‘Phantom by Phantom’ with the genuine ghost icon (Source – Socket.dev) Since the operator controls that server, it could return a |
| ipv4 | 104.21.34.69 | t Subdomain exodus[.]bonto[.]io Provisioned host IP address 104[.]21[.]34[.]69 Network indicator IP address 172[.]67[.]155[.]198 Net |
| ipv4 | 172.67.155.198 | IP address 104[.]21[.]34[.]69 Network indicator IP address 172[.]67[.]155[.]198 Network indicator C2 endpoint https://phantom [.]bont |
| md5 | 30b17a249a34fdf5d2be64b3dfcc8494 | ID -5433023573 Exfiltration AMO developer account anonymous-30b17a249a34fdf5d2be64b3dfcc8494 (user id 20229996) Phantom impersonator AMO developer accou |
| md5 | 3efb89873d4c425c012cd1cb1736629a | 29996) Phantom impersonator AMO developer account anonymous-3efb89873d4c425c012cd1cb1736629a (user id 20231205) Jupiter impersonator AMO developer accou |
| md5 | ca2bf8b1ba371a1426c1049d9dad8168 | 31205) Jupiter impersonator AMO developer account anonymous-ca2bf8b1ba371a1426c1049d9dad8168 (user id 20229610) Bitget impersonator Add-on ID 3092199, v |
| sha256 | 311c49974f28d33947b8b74d78b48f51855eacac182d519a4fe1daa6af7f30e9 | 0d3-6e92f5c7481b} Bitget impersonator (TabFlow Pro) SHA-256 311c49974f28d33947b8b74d78b48f51855eacac182d519a4fe1daa6af7f30e9 Phantom XPI (ha-25.6.0.xpi) SHA-256 999bccd41188a238a50d05b |
| sha256 | 999bccd41188a238a50d05b5aca8e35af45d107f32d7443389313816f0cb226a | 82d519a4fe1daa6af7f30e9 Phantom XPI (ha-25.6.0.xpi) SHA-256 999bccd41188a238a50d05b5aca8e35af45d107f32d7443389313816f0cb226a Phantom second-stage payload (2026-10-21) SHA-256 fd7b138f4 |
| sha256 | e688bff5df32f209b4ebb882985e3ad19ddee68666405c39ff523307068a8611 | a3d91f7451d7b95aabcf6a Jupiter XPI (j_i-1.19.2.xpi) SHA-256 e688bff5df32f209b4ebb882985e3ad19ddee68666405c39ff523307068a8611 Bitget XPI (3092059-2.21.8.xpi) Note: IP addresses and doma |
| sha256 | fd7b138f4fba003db332a4eee833e84491bf7ffec5a3d91f7451d7b95aabcf6a | 6f0cb226a Phantom second-stage payload (2026-10-21) SHA-256 fd7b138f4fba003db332a4eee833e84491bf7ffec5a3d91f7451d7b95aabcf6a Jupiter XPI (j_i-1.19.2.xpi) SHA-256 e688bff5df32f209b4ebb8 |
From the original article
5 min read at cybersecuritynews.com
Three malicious Firefox extensions posed as the Phantom, Jupiter, and Bitget crypto wallets to steal recovery phrases and private keys. Whoever holds these secrets controls the wallet and every coin in it. All three listings were live on the Firefox Add-ons store during the research and have since been removed.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.