Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets

Summary

Socket's Threat Research Team found a cluster of malicious Firefox extensions that impersonate the Phantom, Jupiter, and Bitget crypto wallets to steal recovery phrases and private keys. The extensions use Unicode homoglyphs to copy the brand names and send stolen secrets to brand-named subdomains of the bonto[.]io command-and-control apex. The Phantom impersonator also loads and runs a second-stage stealer from a server at runtime, and all three listings were removed from Firefox Add-ons by publication.