Poisoned Pipeline / Incidents / AS60
Firefox Add-ons crypto-wallet theft
Socket documented 77 malicious Firefox Add-ons impersonating crypto
wallets and Web3 helpers. Once enabled they intercepted wallet
interactions in the page, stole seeds and private keys, and forwarded
them to attacker infrastructure. Companion campaign to the Chrome/Edge
drainers (AS58), on Mozilla’s store.
On 7 October 2026 Socket reported 16 more listings and assessed, with
high confidence, that they continue this August campaign. Four are
Rabby Wallet clones branded Raabby WaIIet. They hook mnemonic and
private-key import and send the raw secret to a Cloudflare Worker in
a GET query. Twelve are OKX Wallet clones. Eleven send a 12- or
24-word phrase to a Worker; sipoo-grozza@browserweb.com ships broken
and does not load its background script. Fifteen contact
icy-star-f45c.workers.dev. The broken variant uses
fondationanimalaidrelief.workers.dev and the same frontend. Every
manifest declares Firefox data collection permission none. Socket
says Mozilla had unpublished these 16 as of 5 October. No confirmed
theft of a named wallet is in the report.
Mapped techniques
- T0109 Publish malicious artifact
- T0110 Advertise malicious artifact
- T0136 Brandjacking
- T0154 Malicious IDE extension
- T0184 Harvesting sensitive information from files
supply-chain malicious firefox add-ons
77 listings on addons.mozilla.org in the August report. Sixteen
more in the 7 October continuation, unpublished by Mozilla as
of 5 October.
Wallet / Web3 impersonation in Firefox search.
Lookalike wallet product names.
Browser-extension analogue with page-script access.
Seed phrases and private keys from wallet UIs.