16 Malicious Firefox Extensions Disguised as Crypto Wallets Steal Recovery Phrases

Researchers have identified 16 malicious Mozilla Firefox extensions that pose as cryptocurrency wallet portals and desktop utilities to steal user recovery phrases and private keys. The deceptive add-ons intercept sensitive data during wallet import flows and attempt to transmit the stolen secrets to remote servers controlled by threat actors. The extensions masquerade as legitimate wallet tools, making them difficult for users to distinguish from genuine software. Distribution occurred via addons.mozilla.org and other channels, affecting the global Mozilla Firefox browser ecosystem. No specific victim counts or financial loss figures were provided in the initial report, but the potential for unauthorized access to cryptocurrency wallets is significant. Mozilla Firefox users are advised to review their installed extensions and remove any suspicious add-ons immediately, ensuring their browser is updated to the latest version to benefit from any security enhancements.