{"id":"CMP-202610-fake-phantom-jupiter-and-bitget-wallet-extensions-on-firefox","kind":"campaign","aliases":[],"related":[],"title":"Fake Phantom, Jupiter and Bitget wallet extensions on Firefox Add-ons steal recovery phrases and private keys and drain funds (bonto.io)","description":null,"summary":"Socket Threat Research (2026-10-27) found malicious Firefox add-ons using Unicode homoglyph names to pass as the Phantom, Jupiter and Bitget crypto wallets. They grab BIP-39 recovery phrases and EVM/Solana private keys from wallet imports, page inputs, paste events and the clipboard, and send them to brand-named subdomains of bonto[.]io. The fake Phantom add-on also loads a second-stage stealer from the server at runtime, injects it into every page, and bundles a drainer that sweeps funds across EVM chains, Solana and Bitcoin. It serves an inactive config during Mozilla review. Anyone who installed these add-ons from AMO and entered or showed a seed phrase or key is at risk. All three were live during analysis and have since been removed. The coinbase. and exodus. subdomains on bonto.io are also set up, so more brands may be targeted. When the campaign started and how many people installed the add-ons are unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-27T19:49:45+00:00","products":[{"name":"Firefox Add-ons (AMO)","fixed":[],"vendor":"Mozilla"},{"name":"Phantom wallet","fixed":[],"vendor":"Phantom"},{"name":"Jupiter wallet","fixed":[],"vendor":"Jupiter"},{"name":"Bitget Wallet","fixed":[],"vendor":"Bitget"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look in Firefox (about:addons, or enterprise extension inventory) for the AMO add-on IDs 3092199 (fake Phantom), 3092666 (fake Jupiter) and 3092059 (fake Bitget, manifest name 'TabFlow Pro'). Also look for any wallet add-on whose name uses homoglyphs or whose publisher is not the official one. In DNS and proxy logs, look for traffic to bonto[.]io or its subdomains (phantom., jupiter., bitget., coinbase., exodus.), including GET phantom[.]bonto[.]io/config. On-chain payout addresses: EVM 0x93ce11fAA9FC83741e8b392879b383bcc5f7f3Ad, SOL GCo8tAh5WjAuH51bnRZtkmKDRuoXHFDNz9MZY25Zuvsr, BTC bc1qrsfyjrsel924nny9q0qak5cfyf7pahmsydwnrq.","fix":"Remove the add-ons and block bonto[.]io. Removing the add-on does not undo the theft: treat any seed phrase or private key typed into, imported into or shown in a browser with these add-ons as compromised. Create a new wallet with a new seed on a clean device and move the funds. Only install wallet extensions through the official link on the wallet vendor's site, and allow-list browser extensions on company machines.","status":"open","published_at":null,"first_seen_at":"2026-10-27T19:49:45+00:00","triaged_at":"2026-10-27T19:49:45+00:00","updated_at":"2026-10-27T19:49:45+00:00","category":"package","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':57B '-202610':24A '-27':58B '-39':82B '2026':56B 'across':140B 'add':11A,40A,63B,114B,159B,214B 'add-on':10A,62B,113B,158B,213B 'add-ons':39A 'also':116B,194B 'amo':42A,162B 'analysi':180B 'and':29A 'anyon':154B 'bip':81B 'bitcoin':145B 'bitget':5A,30A,47A,76B 'bonto':108B 'bonto.io':22A,35A,192B 'brand':104B,199B 'brand-nam':103B 'bundl':134B 'campaign':49B,205B 'chain':142B 'clipboard':98B 'cmp':23A 'coinbas':187B 'config':150B 'crypto':77B 'drain':20A 'drainer':136B 'earli':51B 'early-warn':50B 'enter':164B 'event':95B 'everi':131B 'evm':141B 'evm/solana':86B 'exodus':189B 'extens':7A 'extensions':32A,37A 'fake':1A,26A,111B 'fake-phantom-jupiter-and-bitget-wallet-extensions-on-firefox':25A 'firefox':9A,34A,38A,61B 'found':59B 'fund':21A,139B 'grab':80B 'homoglyph':67B 'import':91B 'inact':149B 'inject':128B 'input':93B 'instal':156B,211B 'io':109B 'jupit':3A,74B 'jupiter':28A,45A 'key':18A,88B,171B 'live':178B 'load':117B 'malici':60B 'mani':209B 'may':200B 'mozilla':152B 'name':68B,105B 'on':12A,33A,64B,160B,215B 'ons':41A 'page':92B,132B 'pass':70B 'past':94B 'peopl':210B 'phantom':2A,27A,43A,73B,112B 'phrase':15A,84B,169B 'privat':17A,87B 'recoveri':14A,83B 'remov':185B 'research':55B 'review':153B 'risk':174B 'runtim':127B 'second':120B 'second-stag':119B 'seed':168B 'send':100B 'serv':147B 'server':125B 'set':195B 'show':166B 'sinc':183B 'socket':53B 'solana':143B 'stage':121B 'start':206B 'steal':13A 'stealer':122B 'subdomain':106B,190B 'sweep':138B 'target':202B 'threat':54B 'three':176B 'unicod':66B 'unknown':217B 'use':65B 'wallet':6A,31A,36A,44A,46A,48A,78B,90B 'warn':52B","nicknames":["bonto.io wallet extensions"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-fake-phantom-jupiter-and-bitget-wallet-extensions-on-firefox","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-27T19:49:45+00:00","fetched_at":"2026-10-27T19:49:45+00:00","note":null}],"documents":[{"id":7486,"url":"https://x.com/SocketSecurity/status/2115158901435896006","title":"@SocketSecurity: Socket uncovered malicious Firefox extensions impersonating Phantom, Jupiter, an","kind":"post","source":"x","text":"Socket uncovered malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget to steal recovery phrases and private keys. The fake Phantom wallet also bundled the operator’s backend for automatically draining funds.\n\nhttps://t.co/yaU2lZoR5d\n\nlikes 0 reposts 1","published_at":"2026-10-27T19:09:14+00:00","relation":"describes","confidence":null,"note":null},{"id":7587,"url":"https://t.co/yaU2lZoR5d","title":"Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets (Socket Threat Research)","kind":"blog","source":"analyst","text":"Socket Threat Research (Kush Pandya, Oct 27 2026): malicious Firefox Add-ons (AMO IDs 3092199 Phantom impersonator, 3092666 Jupiter, 3092059 Bitget / manifest name 'TabFlow Pro') use Unicode homoglyph names to impersonate Phantom, Jupiter and Bitget wallets and steal BIP-39 recovery phrases and EVM/Solana private keys. Exfil to brand subdomains of bonto[.]io (phantom., jupiter., bitget.; coinbase. and exodus. also provisioned), behind Cloudflare. Phantom fake has a remote loader fetching phantom[.]bonto[.]io/config (active:true at analysis) and injecting into the main world of every page; bundles server.js drainer (Telegram bot, auto-sweep to EVM 0x93ce11fAA9FC83741e8b392879b383bcc5f7f3Ad, SOL GCo8tAh5WjAuH51bnRZtkmKDRuoXHFDNz9MZY25Zuvsr, BTC bc1qrsfyjrsel924nny9q0qak5cfyf7pahmsydwnrq) and server-review.js to evade Mozilla review. Phantom fake had 546 reviews (3.9). All three were live on AMO during analysis, removed as of publication. Install counts not stated.","published_at":"2026-10-27T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}