Disclaimer: Information found on CryptoreNews is those of writers quoted. It does not represent the opinions of CryptoreNews on whether to sell, buy or hold any investments. You are advised to conduct your own research before making any investment decisions. Use provided information at your own risk.
CryptoreNews covers fintech, blockchain and Bitcoin bringing you the latest crypto news and analyses on the future of money.
Cybersecurity specialists from Socket’s Threat Research Team have identified three malicious extensions for the Mozilla Firefox browser that impersonated the Phantom, Jupiter, and Bitget cryptocurrency wallets. These programs were capable of stealing seed phrases and private keys.
Thieves copied the names, icons, and promotional text of the genuine wallets, allowing users searching for verified wallets in the store to accidentally install the fake applications. Socket’s Threat Research specialists discovered that the extensions transmitted stolen data to subdomains of a single command-and-control server: bonto[.]io.
The name of the fake Phantom extension used visually similar characters, making it appear identical to the genuine product. Thieves copied Phantom’s original ghost icon and named the extension “Official Phantom Wallet (Firefox Update).” The scammers positioned the fake Jupiter extension as a product of Jupiter Exchange, while the malicious extension mimicking Bitget used the name TabFlow Pro but displayed Bitget branding to users.
Related Posts
The malware impersonating Phantom tracked the input of mnemonic phrases consisting of 12, 15, 18, or 24 words, as well as private keys for Ethereum and Solana networks. The program read the contents of text fields and clipboard pastes. Stolen data was sent to the attacker’s server in JSON format. The fakes impersonating Jupiter and Bitget contained a built-in data theft mechanism that directly sent mnemonic phrases to the domains jupiter[.]bonto[.]io or bitget[.]bonto[.]io.
The fake Jupiter extension also requested access to Trezor Connect. The fake Phantom package included a custom backend drainer—a Node.js server.js file. It saved stolen secret data to local files, sent it to a Telegram bot, and then initiated the transfer of assets to pre-prepared addresses in Bitcoin, Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, and Solana networks.
Scammers artificially inflated the reputation of their products, according to Socket’s Threat Research analysts. Within just a couple of days, the number of reviews for the fake Phantom application grew from 275 to 546, and its rating rose from 2.9 to 3.9. The number of victims and potential loss amounts were not specified. All three extensions have since been removed from Firefox.
This is not the first time Socket experts have identified such schemes. Recently, they discovered 16 malicious extensions for Firefox that copied the interfaces of Rabby and OKX wallet platforms. The extensions disguised themselves as useful programs: wallet portals, desktop utilities, and browser tools.
