A malicious Firefox extension shipped with two servers: one for Mozilla's reviewers, and one for after approval.
Socket's Threat Research Team found three Firefox add-ons posing as popular crypto wallets. They copied the real names with Unicode homoglyphs, reused the real icons, and stole recovery phrases and private keys.
One package bundled server-review.js, a stripped server that returns an inactive config during review. A code comment says the payload reaches the extension only "after approval flip." From then on, a loader fetches the stealer from the attacker's server and runs it in every page the victim opens. The same package carried a drainer that sweeps funds on nine chains. And all three packages shipped a complete stealer in the signed code itself.
Daily users were low. But the infrastructure was live, with exfiltration hosts already set up for two more wallet brands. All three listings are now removed.
My take: marketplace review is useful and incomplete. It checks one version at one moment. An extension that fetches code at runtime can show reviewers one thing and users another. Judge it by what it can do: which sites it can read, and whether it can pull new code.
For security teams: allowlist the extension IDs you use, flag any extension that asks for all-site access plus tabs or scripting, and block bonto[.]io. For users: get wallets only from the vendor's own site.
socket.devMalicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet SecretsMalicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.