Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Crypto Wallet Keys

Three malicious Firefox extensions posed as the Phantom, Jupiter, and Bitget crypto wallets to steal recovery phrases and private keys.

Whoever holds these secrets controls the wallet and every coin in it. All three listings were live on the Firefox Add-ons store during the research and have since been removed.

The fake add-ons copied the names, icons, and marketing text of well-known wallets. Anyone searching the store for a trusted wallet could easily install one by mistake. This is the same trick seen in other fake crypto wallet screens used to trap careless users.

Researchers at Socket.dev identified the malware and shared their findings on October 27, 2026. Their team found that the extensions send stolen secrets to subdomains of one command-and-control domain, bonto[.]io.

The Phantom copy also carried a hidden loader that could change its behavior after Mozilla approved it.

Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget

The Phantom listing used lookalike Unicode letters in its name, so it appeared on screen as “Phantom.” It reused Phantom’s real ghost icon and called itself “Official Phantom Wallet (Firefox Update).”

The Jupiter copy claimed it was built by Jupiter Exchange. The Bitget copy used the internal name “TabFlow Pro” but showed Bitget branding to users. None of them offered a privacy policy, and all declared that they collect no data.

The Phantom package held a small loader added to its background script. The loader hid its server address inside a list of numbers, then fetched a settings file from phantom[.]bonto[.]io.

That file told the extension whether to run and carried a base64-encoded stealer. The code ran inside every page the victim opened, which let it read the wallet’s own page objects.

Since the operator controls that server, it could return a harmless reply during Mozilla’s review and the real stealer afterward.

The stealer watched for 12, 15, 18, and 24-word recovery phrases, and for Ethereum and Solana private-key formats. It read text boxes, paste events, and the numbered phrase grid that wallets show on their secret-phrase screen.

Captured data was sent to the attacker’s server as JSON. This is not the first time Socket has found this style of theft. It also reported 16 malicious Firefox extensions that copied Rabby and OKX wallet screens earlier this month.

The Jupiter and Bitget fakes worked more simply. They bundled the stealer in the package and sent the recovery phrase straight to jupiter[.]bonto[.]io or bitget[.]bonto[.]io.

The Jupiter copy also asked for access to Trezor Connect, which widened what it could read. Socket noted that all three packages carried a full, always-on stealer inside the signed code Mozilla reviewed, so the remote loader was only an extra layer.

Hidden Infrastructure and Real-World Risk

The Phantom package went further and included the operator’s own drainer backend, a Node.js file named server.js.

It saved stolen secrets to local files, sent them to a Telegram bot, and moved funds to fixed payout addresses on Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana, and Bitcoin.

A code comment said the payload would work only “after approval flip,” meaning after Mozilla’s review. A second file, server-review.js, returned an inactive reply while the review was underway.

All the exfiltration servers sit behind Cloudflare, which hides the real host. Socket also found working subdomains for coinbase[.]bonto[.]io and exodus[.]bonto[.]io.

That suggests the group planned to impersonate Coinbase Wallet and Exodus too, although no matching store listings were found. Each fake add-on came from its own throwaway developer account, which makes bulk takedowns slower.

Phantom and Jupiter packages also contained a CLAUDE.md file, an AI jailbreak prompt that was never loaded. Socket says this points to AI-assisted malware writing and an attempt to fool AI-based review.

The campaign also faked its reputation. Over about two days, the Phantom listing’s reviews jumped from 275 to 546, and its rating rose from 2.9 to 3.9.

That pushed down one-star reviews from users who said they lost funds, though those claims are unverified. The listings had only one to three daily users, but the servers were active.

The group looks like a repeat offender, much like the earlier Offside Wallet Theft Factory campaign that Socket tied to 77 Firefox add-ons.

Wallet users should install extensions only through links on the wallet maker’s official website, not through store search. No real wallet will ask for a recovery phrase on a web page.

Anyone who typed a phrase or key into one of these add-ons should create a new wallet on a clean device and move their funds right away.

Deleting the extension does not make a leaked phrase safe. Security teams should block the bonto[.]io domain and its subdomains and look for extensions that fetch settings and then run the result as code.

Browser add-ons are not the only wallet risk. The Odyssey Stealer campaign shows that attackers also hunt wallet data on desktops.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Crypto Wallet Keys appeared first on Cyber Security News.