16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
- ID
- 33121
- Status
- summarized
- Published
- 08 Oct 2026, 5:46 PM
- Fetched
- 08 Oct 2026, 5:56 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.0
- Created
- 08 Oct 2026, 5:57 PM
- Tags
- Audience
- developersvibe_coders
What happened
Socket researchers discovered 16 malicious Firefox extensions that impersonate Rabby and OKX wallets: four are Rabby clones and the rest target OKX Wallet. The extensions intercept recovery phrases and private keys during wallet import flows and exfiltrate them to attacker-controlled Cloudflare Workers at *.icy-star-f45c.workers.dev, with all but one contacting that domain. All extensions were removed as of October 5, 2026; users who entered real recovery phrases or private keys into the fake interfaces should assume compromise, create a new wallet from a clean system, and move assets.
Why it matters
The urgent action is narrow: if you or a teammate installed any of the listed extensions and entered a real seed phrase or private key, treat the wallet as compromised and migrate assets from a clean machine. For most developers and founders, this is not a reason to change AI/agent or SaaS tooling; it is a concrete example that browser-extension wallet-import flows are a secret-exfiltration target, so use hardware wallets or isolated environments for recovery phrases.
Discussion angle
How would you verify a browser wallet extension before entering a seed phrase, and should teams ban recovery-phrase entry in any browser-based workflow after this Rabby/OKX clone wave?