Fake Phantom, Jupiter, and Bitget Firefox Extensions Steal Crypto Recovery Phrases
Do Son 
The Phantom impersonator renders as “Phantom by Phantom” with the genuine ghost icon, and its rating was inflated to 3.9 across 546 reviews at the time of writing.
TL;DR
Socket researchers uncovered three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget cryptocurrency wallets on Mozilla’s official store. Using Unicode homoglyphs to spoof legitimate brand names, these malicious Firefox wallet extensions capture BIP-39 recovery phrases and private keys. Before Mozilla removed the listings, the extensions routed stolen secrets to brand-named subdomains under a single command server.
Delivery and Attribution
The campaign distributed three signed packages through the official Firefox Add-ons marketplace under add-on IDs 3092199, 3092666, and 3092059. To trick users, the Phantom and Jupiter listings used Unicode homoglyph characters that looked identical to the real brand names while copying official icons and marketing text. Meanwhile, the Bitget listing used “TabFlow Pro” in its manifest file but displayed Bitget Wallet branding on the store page. To hide one-star complaints from victims reporting stolen funds, the operator inflated the fake Phantom listing from 275 reviews to 546 reviews over two days, raising its average score from 2.9 to 3.9. Despite the inflated review count, Mozilla telemetry recorded between one and three average daily users per extension before takedown.
Confirmed Versus Suspected Attribution
Confirmed technical attribution ties all three malicious Firefox extensions to a single operator because all stolen data flows to subdomains of the same Cloudflare-fronted apex domain. Furthermore, each add-on was uploaded from a separate throwaway anonymous Mozilla developer account to slow down bulk removals. While confirmed attribution to a known cybercrime group does not exist, suspected attribution points to an operator using AI coding tools. Specifically, both the Phantom and Jupiter packages included an unused CLAUDE.md file containing an AI-assistant jailbreak prompt designed to subvert automated code reviews.
Infection Chain
Each extension requests permission to read data across all websites while falsely declaring in its store privacy panel that it collects no user data. According to the Socket Threat Research report, “Each signed package carries a complete, always-on stealer, so the malicious code is present in what Mozilla reviewed. The Phantom impersonator adds a second layer: a loader that pulls a stealer from a server at runtime and runs it in the page, letting the operator swap or refresh the payload after review.”
Runtime Main-World Injection
In the Phantom variant, a loader hidden inside the background service worker rebuilds its command domain from a character-code array and fetches a JSON configuration file. When the server’s active flag is set to true, the loader decodes a 4,029-byte Base64 script and executes it inside the main world of every open browser tab. Running in the main world lets the script hook the webpage’s Solana wallet provider directly to grab connected public keys. If main-world injection fails on internal extension pages, the loader falls back to the isolated content-script world.
In contrast, the Jupiter and Bitget variants rely entirely on bundled scripts. Jupiter ships a 621-kilobyte trojanized background script alongside an input hook and requests host access to Trezor Connect. Similarly, the Bitget package hooks local wallet storage to steal seed phrases as they are decrypted and redirects new tabs to a local wallet import screen.
Command-and-Control and Data-Exfiltration Behavior
Once active, the injected stealer scans every form input, text area, paste event, and webpage text node. It uses regular expressions to match 12, 15, 18, or 24-word BIP-39 recovery phrases as well as Ethereum and Solana private keys. Next, it sends the stolen strings via JSON POST requests to brand-specific subdomains on the operator’s server. Domain probing also uncovered active subdomains prepared for Coinbase Wallet and Exodus.
In addition, the signed Phantom archive accidentally bundled the operator’s own Node.js backend files, named server-review.js and server.js. As the report notes, “After approval the operator switches to the live server.js, the “approval flip” the comment refers to.” Once triggered, the drainer script forwards stolen keys to a Telegram chat and sweeps victim funds to hardcoded wallet addresses across nine blockchains: Ethereum, BNB Smart Chain, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana, and Bitcoin.
Defense and Detection Guidance
Cryptocurrency holders should install wallet add-ons only by following links on the vendor’s official website rather than searching inside browser extension stores. Enterprise security teams can detect these malicious Firefox wallet extensions by auditing the extensions.json file inside Firefox user profiles for unknown add-on IDs and enforcing strict extension allowlists via group policy. Finally, network defenders should block DNS lookups to the operator’s command domain and alert on browser extensions that fetch external configuration paths and pass the response to eval or script execution APIs. Anyone who typed a seed phrase into these extensions must transfer their assets to a fresh wallet generated on a clean device immediately.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
