What are the Firefox extensions that steal cryptocurrency wallets and how can I avoid them?
In July 2026, over 40 malicious Firefox extensions were discovered targeting popular crypto wallet users such as MetaMask, Trust Wallet, and Coinbase. These fake add-ons mimicked real wallet tools, using the same names, logos, and fake 5-star reviews to trick users. Once installed, they silently stole wallet keys, seed phrases, and IP addresses, putting user funds at risk. Mozilla has removed most of these extensions and activated an early detection system, but users must still stay cautious when installing browser add-ons. Only use verified publishers, avoid suspicious reviews, and use hardware wallets for added safety.
Quick answer: More than 40 malicious Firefox add-ons copied crypto wallet brands such as MetaMask, Coinbase, Trust Wallet and Phantom, and used fake five-star reviews to look genuine. Once installed, they stole wallet seed phrases and IP addresses. Install wallet extensions only through links on the official wallet site, check the publisher, and never type a seed phrase into an extension prompt.
Key takeaways
- Fake wallet add-ons copy the branding of MetaMask, Coinbase, Trust Wallet and Phantom, then ask for your seed phrase.
- Five-star reviews can be faked, so check the developer name and the install count as well as the rating.
- No genuine wallet will ever ask you to type your recovery phrase into a browser pop-up.
Table of Contents
- What Happened?
- How Do These Malicious Extensions Work?
- Who Is Behind This Attack?
- Mozilla’s Response
- Why Is This Different from Regular Phishing?
- What Can You Do to Stay Safe?
- Real-World Impact
- Conclusion
What Happened?
In July 2025, cybersecurity experts revealed that more than 40 malicious extensions were found on the Mozilla Firefox Add-ons Store. These fake browser add-ons were designed to steal cryptocurrency wallet details, putting thousands of users at risk of losing their digital assets.
These dangerous extensions pretended to be legitimate tools from well-known crypto platforms like:
-
Coinbase
-
MetaMask
-
Trust Wallet
-
Phantom
-
Exodus
-
OKX
-
Keplr
-
MyMonero
-
Bitget
-
Leap
-
Ethereum Wallet
-
Filfox
How Do These Malicious Extensions Work?
Fake Look, Real Danger
These extensions look and feel just like the real ones. They use the same logos, names, and designs as the original crypto wallet add-ons. They even added hundreds of fake 5-star reviews to appear trustworthy.
Stealing Wallet Keys and IP Addresses
Once installed, these malicious tools steal your wallet seed phrases and private keys, the sensitive info needed to access your crypto. They also send your IP address to an attacker-controlled server.
This is very dangerous because:
-
The attacker can take full control of your wallet.
-
You may not realize anything is wrong until it’s too late.
-
These attacks happen within your browser, not through emails or websites.
Who Is Behind This Attack?
Experts at Koi Security believe that the threat actors may be Russian-speaking, based on:
-
Russian language comments found in the code.
-
Metadata in files from the attacker’s server.
The campaign has been running since April 2025 and continued uploading new extensions even recently.
Mozilla’s Response
Mozilla has already removed almost all the fake extensions except one (MyMonero Wallet). The company also announced that they are using an “early detection system” to automatically block scam crypto wallet add-ons before they spread widely.
Why Is This Different from Regular Phishing?
Unlike typical phishing scams that use fake websites or scam emails, these extensions:
-
Live inside your browser.
-
Appear trustworthy.
-
Don’t disrupt user experience.
-
Are harder to detect by antivirus or endpoint tools.
This makes them low-effort but high-impact for attackers.
What Can You Do to Stay Safe?
Tips to Protect Your Crypto Wallets
Only download browser extensions from verified publishers.
Double-check the number of users vs. reviews, fake ones usually don’t match.
Avoid installing wallet extensions unless absolutely necessary.
Monitor permissions, don’t allow sensitive data access.
Use hardware wallets for large crypto holdings.
Use browsers with built-in anti-extension scanning like Firefox’s early detection system.
Keep your browser and antivirus tools updated.
Real-World Impact
This incident highlights how simple mistakes like installing a fake extension can lead to major financial losses. With the popularity of cryptocurrencies growing, attackers are using smarter and sneakier methods to trick users and steal digital assets.
If you're a crypto user or trader, be extra cautious about browser extensions, what looks helpful could be hiding a dangerous trap.
Conclusion
This large-scale attack reminds us how important it is to:
-
Stay alert online.
-
Question anything that looks too good or too polished.
-
Regularly monitor crypto wallets and use multi-factor authentication whenever possible.
Security is everyone’s responsibility as well as the job of experts.
Related reading
Frequently Asked Questions
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Wow
0
Sad
0
Angry
0
Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.
