Malicious Firefox Extensions Are Targeting Crypto Wallets to Steal Private Keys

According to a Decrypt report cited by blockchain.news, the malicious add-ons mimic legitimate browser-based wallets while embedding code that drains funds on contact.

The Threat Vector

The cluster targets the browser layer rather than centralized exchanges — a meaningful pivot in attacker methodology. Security researchers flagged the extensions for replicating trusted wallet UIs, a low-effort disguise that exploits brand recognition. Once installed, the add-on requests standard wallet connection permissions, then quietly routes signed data off-device. This is a permission-scope attack: the extension operates within the trust the user grants at installation. No phishing click required after the add-on lands. Private keys, once exfiltrated, become a one-way liquidity sink for the victim.

Why This Matters for Browser-Based Wallets

The shift from exchange exploits to individual wallet infrastructure carries direct implications for self-custody users. Firefox, like Chrome, runs extensions with elevated read access to page content and injected scripts. That architecture is precisely what makes a fake wallet viable: it can sit between the user and a legitimate dApp, intercepting the transaction layer. Browser-based crypto storage has grown into a significant retail segment, and the attack surface scales with adoption. Extension stores remain a soft perimeter — review processes vary, takedown latency runs in days, not minutes.

Practical Checks Before Connecting a Wallet

• Publisher provenance. Verify the developer name against the official wallet project site. Mismatches are the first red flag.
• Install base. Low download counts combined with high review velocity suggest fabrication.
• Permission scope. A wallet extension should not require access to all sites. Broad host_permissions signal data-harvest intent.
• Code audit status. Reputable wallets publish open-source repositories. Closed-source extensions handling keys warrant skepticism.
• Connection behavior. Test with a disposable wallet first. Reject any unexpected signature requests.

Verdict

Extension-borne wallet theft is now a recurring category, not an isolated incident. The yield on this attack vector — low development cost, broad distribution, direct drain mechanics — keeps it attractive. Until browser stores tighten review standards, the defensive burden sits with the user. Audit every extension before granting wallet permissions, and assume any add-on requesting signing authority is compromised until proven otherwise.