Three fake wallet extensions in the Firefox Add-ons store impersonated Phantom, Jupiter and Bitget and stole users’ wallet recovery phrases and private keys, according to research published October 27 by security firm Socket and reported by Cryptika.
Summary
- Socket found three malicious Firefox add-ons posing as Phantom, Jupiter and Bitget wallets; all were live during the research and have since been removed.
- The code watched for 12, 15, 18 and 24-word recovery phrases and Ethereum and Solana private keys, and sent them to subdomains of bonto[.]io.
- The working stealer was inside the signed code Mozilla reviewed; the Phantom fake fetched an extra payload remotely, set to arm only “after approval flip.”
- The Phantom listing’s reviews were faked from 275 to 546 in about two days, lifting its rating from 2.9 to 3.9.
The Phantom fake, listed as “OFFICIAL PHANTOM WALLET (Firefox Update),” used lookalike Unicode letters and Phantom’s real ghost icon. The Bitget impersonator carried the internal name “TabFlow Pro.” Each fake add-on came from its own throwaway developer account.
A stealer inside the signed code
The add-ons monitored text boxes, paste events and the numbered phrase grids wallets display on their secret-phrase screens. Captured phrases and keys were sent as JSON to brand-named subdomains of a single command-and-control domain, bonto[.]io; Socket also found provisioned coinbase[.]bonto[.]io and exodus[.]bonto[.]io hosts, though no matching store listings.
The Phantom fake went further: a loader fetched a configuration and encoded payload from the operator’s server after installation, and the package bundled a drainer backend that forwarded secrets to a Telegram bot and swept funds to fixed addresses across nine networks, including Ethereum, Solana and Bitcoin. A code comment said the payload would work only “after approval flip” — after passing the store’s review.
What to do
Socket’s guidance is direct: install wallet extensions only through links on the wallet maker’s official website, never through store search results. Anyone who typed a recovery phrase or private key into one of these add-ons should create a new wallet on a clean device and move funds immediately — deleting the extension does not make a leaked phrase safe.
The same firm reported 16 malicious Firefox extensions copying Rabby and OKX earlier in October, suggesting the campaign is a continuing one rather than a single incident.
