Loading malware…
14 distinct techniques documented for this family, organized by ATT&CK tactic.
In some cases, the add-ons first appeared on the official Firefox extensions marketplace as sports score or utility shells, before they were turned into wallet-stealing malware under the same Firefox ID.
The wallet secrets are stolen using two methods: either remotely loading a fake wallet page or baking the functionality into the extension itself.
седум користат Supabase проекти контролирани од напаѓачите како далечински прекинувачи за динамичко пренасочување
The delivery vector is malicious Firefox Add-ons impersonating wallets and disguised utilities, distributed through the Firefox Add-ons store.
13 модифицирани верзии на Rabby Wallet ги крадат сериски запишаните keyring податоци пред нивното локално шифрирање
A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, TronLink, and other Web3 products.
Many pose as crypto wallets, copying real branding and screenshots. Others hide as themes, VPNs, or note-taking tools.
13 модифицирани верзии на Rabby Wallet ги крадат сериски запишаните keyring податоци пред нивното локално шифрирање
Among those 40 extensions, seven use threat actor-controlled Supabase projects as remote switches to server phishing or decoy content dynamically; 15 capture recovery phrases, private keys, and other wallet secrets, and exfiltrate them through Cloudflare Workers; 13 modified Rabby Wallet builds exfiltrate serialized keyrings before local encryption; and the remaining five capture credentials and clipboard data through hard-coded command and control (C2) infrastructure.
The fake page then asks victims to import a wallet using a recovery phrase. Submitted recovery phrases and keys go to attacker-run Cloudflare Worker deployments.
Thirteen extensions exfiltrate serialized keyring data before local encryption runs. The theft hooks a normal save routine, so the wallet still works.
13 модифицирани верзии на Rabby Wallet ги крадат сериски запишаните keyring податоци пред нивното локално шифрирање
Among those 40 extensions, seven use threat actor-controlled Supabase projects as remote switches to server phishing or decoy content dynamically; 15 capture recovery phrases, private keys, and other wallet secrets, and exfiltrate them through Cloudflare Workers; 13 modified Rabby Wallet builds exfiltrate serialized keyrings before local encryption; and the remaining five capture credentials and clipboard data through hard-coded command and control (C2) infrastructure.
The fake page then asks victims to import a wallet using a recovery phrase. Submitted recovery phrases and keys go to attacker-run Cloudflare Worker deployments.
A separate cluster of five extensions steals credentials and clipboard contents. The clipboard capture is split into numbered chunks so the server can rebuild large content.
That data flows to a hardcoded command-and-control server over plain HTTP.
These loaders pull a URL from a threat actor-controlled Supabase project. A single value flips the extension between a decoy and a live phishing page.
Cloudflare Workers receive stolen recovery phrases and keys.
209 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.