Fake wallet add-ons for Phantom, Jupiter and Bitget slipped into Firefox

Socket Threat Research spotted three malicious browser extensions in the Firefox store that perfectly mimicked real crypto wallets. The fakes copied icons and descriptions so users searching for Phantom, Jupiter or Bitget would install the wrong one, then forwarded stolen data to subdomains under bonto[.]io.

The Phantom clone harvested 12- to 24-word seed phrases and private keys for Ethereum and Solana, saved them locally, pushed them to a Telegram bot and triggered transfers across Bitcoin, Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche and Solana. The Jupiter fake asked for Trezor Connect permissions, while the Bitget imitation ran under the name TabFlow Pro.

To look legitimate the attackers inflated review counts: the Phantom fake jumped from 275 to 546 reviews and its rating rose from 2.9 to 3.9 in just days. All three extensions have since been removed.

It was not the first such campaign; the same researchers earlier uncovered 16 similar malicious add-ons targeting Rabby and OKX wallets.

Based on information from cryptonews.net