There’s a new malware in the Web3 world that is targeting crypto users through fake Firefox extensions, and the threat is far from over. Security researcher Yuval Ronen, in his latest Medium post, has revealed that there’s a large-scale, ongoing operation involving over 40 malicious Firefox extensions that impersonate popular cryptocurrency wallet tools. Obviously, the aim is to steal users’ private wallet credentials and exfiltrate them to remote attacker-controlled servers, leaving crypto assets wide open to theft.
As always, the malicious extensions were designed to mimic official wallets from major platforms like MetaMask, Coinbase, Trust Wallet, Phantom, Exodus, OKX, and more. Interestingly, they used real branding, logos, and even open-source code from the legitimate tools they impersonated. The result was a convincing trap: fully functional extensions that quietly looted user secrets behind the scenes.
