Malicious Firefox Extensions Steal Crypto Wallet Recovery Phrases

Researchers have identified a cluster of sixteen malicious Mozilla Firefox extensions that can steal cryptocurrency wallet recovery phrases and private keys while users import wallets into the browser. The extensions masquerade as legitimate wallet portals, desktop utilities, and browser tools but contain code designed to intercept recovery phrases entered during import flows and attempt to send those secrets to an unknown destination. ¹

These add-ons exploit the broad permission set granted to Firefox extensions, giving them access both at HTTP level and native code execution within sandboxed contexts. This dual capability allows them to capture high‑entropy recovery phrases—normally protected by hardware security modules (HSMs)—before the user completes the import process.

Similar attacks targeting MetaMask were observed since late 2022, resulting in losses estimated at over $34 million across multiple exchanges. ¹

Mozilla has recently focused on improving extension review processes after past vulnerabilities exposed similar threats. However, the current malicious submissions appear to use compromised developer accounts to bypass initial scrutiny, indicating audits should prioritize verifying contributor identities before publishing updates. Users are advised to double‑check URLs carefully whenever entering sensitive data online, especially when interacting with unfamiliar platforms for new cryptocurrency ventures.