Skip to content
NewA calmer, faster ZeroHour
StoryMalwaremedium

Fake Firefox wallet add-ons stole crypto secrets, then were removed

3 sources · 3 articlesFirst reported Updated ()1
What's new

October 29: Malwarebytes says the add-ons read inputs, pasted text, and on-screen phrases, and genuine Phantom no longer supports its Firefox extension.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Socket says three removed Firefox add-ons impersonating Phantom, Jupiter, and Bitget stole wallet secrets; reported losses remain unverified.

Socket reported on October 27, 2026, that three Firefox add-ons impersonating Phantom, Jupiter, and Bitget collected recovery phrases and private keys and sent them to bonto.io subdomains. The signed packages already contained stealers; the Phantom copy could also fetch remote JavaScript, logged secrets, sent them to Telegram, and moved funds to hardcoded addresses across nine chains. Add-on IDs were 3092199, 3092666, and 3092059. Listings were live during research and removed before publication. Socket says reported wallet losses are unverified. Genuine Phantom says its Firefox extension is no longer supported.

Key facts
  • Add-on IDs: Phantom 3092199, Jupiter 3092666, Bitget 3092059.
  • Jupiter and Bitget sent secrets to matching bonto.io subdomains.
  • Phantom served a 4,029-byte payload and a Base64 stealer from phantom.bonto.io.
  • Extensions sought 12-, 15-, 18-, and 24-word recovery phrases.
  • Reviews rose from 275 to 546 in about two days; losses unverified.
  • Coinbase and Exodus bonto.io names had no matching store listings.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 27, 2026Socket published after the three Firefox listings were removed. · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersNames a live 4,029-byte Phantom payload and Jupiter and Bitget bonto.io hosts.
  • Cyber Security NewsReview jump, Base64 loader, and Coinbase and Exodus subdomains without listings.
  • Malwarebytes LabsPhrase lengths, input and paste theft, and Phantom dropping Firefox support.
Vendors
Mozilla
Products
FirefoxPhantomJupiterBitget
Organizations
SocketSocket.dev

Coverage

oldest first · one row per article · UTC
  1. · 2d ago GBHackersFirst report

    Fake Phantom, Jupiter, and Bitget Firefox add-ons stole wallet keys

    Socket identified add-on IDs 3092199, 3092666, and 3092059; a live config served a 4,029-byte payload.

  2. · 2d ago Cyber Security News

    Malicious Firefox extensions impersonated Phantom, Jupiter, and Bitget

    Socket says the removed listings sent recovery phrases to bonto.io, and Phantom’s package included a multi-chain drainer.

  3. · 1d ago Malwarebytes Labs

    Malicious Firefox extensions impersonate Phantom, Jupiter, and Bitget

    Socket says the add-ons stole recovery phrases and private keys; the Phantom copy sent secrets to Telegram and moved funds.