Researchers have identified 16 malicious Mozilla Firefox extensions that impersonate Rabby and OKX wallet tools and can steal cryptocurrency-wallet recovery phrases and private keys.
Browser extensions can inherit broad access to browsing activity, making extension review an important security control. Users should remove unfamiliar wallet extensions, install software only from trusted publisher listings, and never enter a recovery phrase into an extension or website unless they have independently verified the workflow.
Security teams supporting cryptocurrency operations should maintain an approved-extension list, monitor endpoints for unapproved browser add-ons, and move potentially exposed assets according to established incident procedures. Hardware-wallet use and separate browser profiles can reduce risk, but do not replace verification of extension provenance.
Source: The Hacker News