#Firefox Hit by 40 Fake #Crypto Wallet Extensions Stealing User Credentials


Security researchers have identified over 40 fraudulent Firefox browser extensions designed to steal #cryptocurrency wallet credentials from users.


The malicious extensions impersonated legitimate tools from major crypto services including Coinbase, MetaMask, Trust Wallet, and Phantom.


After installation, these counterfeit extensions secretly collected sensitive wallet information, potentially exposing victims' crypto assets to theft.


The campaign has been active since at least April 2025, with new malicious extensions uploaded as recently as last week.


Many fake extensions featured hundreds of fake five-star reviews to gain user trust and appear legitimate.


Code comments and metadata suggest the operation may originate from a Russian-speaking threat actor group.


The ongoing nature of the uploads indicates the #cybersecurity threat remains active, persistent, and evolving, according to Koi Security.

image
July 03, 2025 at 6:12 PM
3