Live › campaign › CMP-202610-fake-phantom-jupiter-and-bitget-wallet-extensions-on-firefox
Go to dashboardSocket Threat Research (2026-10-27) found malicious Firefox add-ons using Unicode homoglyph names to pass as the Phantom, Jupiter and Bitget crypto wallets. They grab BIP-39 recovery phrases and EVM/Solana private keys from wallet imports, page inputs, paste events and the clipboard, and send them to brand-named subdomains of bonto[.]io. The fake Phantom add-on also loads a second-stage stealer from the server at runtime, injects it into every page, and bundles a drainer that sweeps funds across EVM chains, Solana and Bitcoin. It serves an inactive config during Mozilla review. Anyone who installed these add-ons from AMO and entered or showed a seed phrase or key is at risk. All three were live during analysis and have since been removed. The coinbase. and exodus. subdomains on bonto.io are also set up, so more brands may be targeted. When the campaign started and how many people installed the add-ons are unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 19:49 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Firefox Add-ons (AMO) | – | – | – |
| Phantom wallet | – | – | – |
| Jupiter wallet | – | – | – |
| Bitget Wallet | – | – | – |
TabFlow Pro)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@feross · X5 likes · 0 reposts2026-10-27 20:50“A malicious Firefox wallet extension bundled server-review.js, which returns an inactive config during store review. A code comment says the payload arrives "after approval flip." Review checks one moment. Runtime code can change after. https://t.co/K4mLKPVX4E”
View on X
Posts are quoted with a link to the original. They are data to us, never instructions.
This page as .md · .json · in your agent: get_signal("CMP-202610-fake-phantom-jupiter-and-bitget-wallet-extensions-on-firefox")