40 malicious Firefox extensions caught stealing crypto wallet data

📅 20 August 2026 at 11:04 UTC📰 Cyber InsiderView original source ↗

Socket researchers have uncovered a network of 77 Firefox extensions tied to cryptocurrency wallet theft, credential harvesting, and deceptive software distribution. Of those, 40 were confirmed malicious, while another 37 disguised sports-score applications as unrelated browser utilities and appear connected to the same broader publishing operation. Socket’s Threat Research team linked the extensions through shared … The post 40 malicious Firefox extensions caught stealing crypto wallet data appeared first on CyberInsider.

🤖 AI BriefingAuto-generated threat analysis

🔍Threat Overview

A network of 77 malicious Firefox extensions, tied to cryptocurrency wallet theft and credential harvesting, were identified through shared source code and infrastructure analysis. The activity dates back to at least March 2026 and continued through August.

⚙️Technical Details

Affected Systems

Mozilla Firefox users

Attack Vectors

Phishing loadersRemote-controlled phishing loadersWallet-theft code embedded directly in extensionsMalicious logic intercepting recovery phrases during wallet creation or import

💥Impact Assessment

Severity: high

Who Is at Risk

Mozilla Firefox users, particularly those using cryptocurrency wallets

🛡️Recommended Actions

1Uninstall malicious extensions immediately

2Move affected cryptocurrency funds to a newly created wallet with fresh keys

3Change potentially exposed passwords and revoke active sessions where possible

📦Affected Products

Product Name: Mozilla FirefoxVersion Range: March 9, 2026 - August 3, 2026

Read the full article

This is a curated summary. The complete article is available at Cyber Insider.

Read on Cyber Insider ↗

← Back to feed