.jpeg)
A widespread malicious campaign has been uncovered, targeting Firefox users with over 40 fake cryptocurrency wallet extensions. These deceptive add-ons, impersonating popular wallets like MetaMask, Coinbase, and Trust Wallet, are designed to steal users' sensitive credentials and drain their crypto assets. The campaign has been active since at least April 2025, with new malicious extensions continuously appearing in the Firefox Add-ons store.
Firefox Users Beware: Fake Crypto Wallet Extensions Steal Credentials
Cybersecurity firm Koi Security has identified a significant threat to Firefox users: a campaign deploying more than 40 fraudulent browser extensions. These extensions mimic legitimate crypto wallets, including those from Coinbase, MetaMask, Trust Wallet, Phantom, Exodus, OKX, Keplr, MyMonero, Bitget, Leap, Ethereum Wallet, and Filfox. Once installed, they surreptitiously extract wallet credentials and transmit them to attacker-controlled servers.
-
The campaign has been active since at least April 2025.
-
New malicious extensions are still being uploaded to the Firefox Add-ons store.
-
OKX had previously warned users about fake OKX Wallet Firefox extensions in January, confirming they had not released any official plugins.
Sophisticated Deception Tactics Employed
The attackers utilize sophisticated methods to gain user trust and avoid detection:
-
Fake Reviews: Many malicious extensions feature hundreds of fake 5-star reviews, creating an illusion of legitimacy and widespread adoption.
-
Brand Impersonation: They use identical names and logos to the legitimate services they impersonate, making it difficult for users to distinguish between real and fake.
-
Code Cloning: Threat actors clone the open-source code of authentic wallet extensions and inject malicious logic. This allows them to maintain expected user functionality while secretly exfiltrating data.
This strategy reduces development time and increases the likelihood that security tools will overlook the malicious modifications within seemingly legitimate code.
Broader Crypto Theft Landscape
The Firefox extension campaign is part of a larger trend of evolving cryptocurrency theft methods. Recent incidents highlight the diverse attack vectors:
-
Hardware Attacks: A Chinese crypto investor lost nearly $7 million after purchasing a fake cold wallet that generated keys already known to attackers.
-
Software Attacks: Fake Ledger Live applications, distributed via compromised websites, harvest seed phrases through convincing pop-ups.
-
Physical Phishing: Scammers send fake letters impersonating Ledger via mail, urging users to "validate" wallets through QR codes leading to phishing sites.
According to CertiK's security report, crypto investors lost over $2.2 billion to hacks, scams, and security breaches in the first half of 2025 alone. Wallet-related breaches accounted for $1.7 billion across 34 attacks, while phishing incidents resulted in over $410 million stolen in 132 incidents. Ethereum remains the most targeted blockchain, experiencing 175 security events and over $1.6 billion in losses.
Recommendations for Users
To mitigate the risk of falling victim to these scams, users should:
-
Only install browser extensions from verified publishers.
-
Treat extensions as full software assets.
-
Monitor for unexpected behavior or updates from installed extensions.
-
Be wary of extensions with an unusually high number of generic 5-star reviews.
Mozilla is actively working to identify and remove these malicious add-ons, but user vigilance remains crucial.
Sources
-
40+ Fake Firefox Wallet Extensions Are Stealing Your Crypto, Koi Security Warns, Cryptonews.
-
Crypto Theft Campaign Hits Firefox Users with Wallet Clones, Cointelegraph.
-
Dozens of fake wallet add-ons flood Firefox store to drain crypto, BleepingComputer.
This article was created with support from AI-driven technology, drawing on multiple reputable sources. The final content has been thoroughly reviewed and edited by BlockzHub's editorial team to ensure accuracy, clarity, and coherence. Original reporting sources are credited whenever appropriate and as required. The opinions expressed in this article do not necessarily represent the official views or positions of BlockzHub. This article is intended for informational purposes only and should not be considered financial or professional advice. Investing involves risk, and you should consult a qualified financial advisor before making any investment decisions.