---
id: "CMP-202610-fake-phantom-jupiter-and-bitget-wallet-extensions-on-firefox"
kind: "campaign"
aliases: []
title: "Fake Phantom, Jupiter and Bitget wallet extensions on Firefox Add-ons steal recovery phrases and private keys and drain funds (bonto.io)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Firefox Add-ons (AMO)", "fixed": [], "vendor": "Mozilla"}, {"name": "Phantom wallet", "fixed": [], "vendor": "Phantom"}, {"name": "Jupiter wallet", "fixed": [], "vendor": "Jupiter"}, {"name": "Bitget Wallet", "fixed": [], "vendor": "Bitget"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-27T19:49:45+00:00"
updated_at: "2026-10-27T19:49:45+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-27T19:49:45+00:00"}]
---

# Fake Phantom, Jupiter and Bitget wallet extensions on Firefox Add-ons steal recovery phrases and private keys and drain funds (bonto.io)

Socket Threat Research (2026-10-27) found malicious Firefox add-ons using Unicode homoglyph names to pass as the Phantom, Jupiter and Bitget crypto wallets. They grab BIP-39 recovery phrases and EVM/Solana private keys from wallet imports, page inputs, paste events and the clipboard, and send them to brand-named subdomains of bonto[.]io. The fake Phantom add-on also loads a second-stage stealer from the server at runtime, injects it into every page, and bundles a drainer that sweeps funds across EVM chains, Solana and Bitcoin. It serves an inactive config during Mozilla review. Anyone who installed these add-ons from AMO and entered or showed a seed phrase or key is at risk. All three were live during analysis and have since been removed. The coinbase. and exodus. subdomains on bonto.io are also set up, so more brands may be targeted. When the campaign started and how many people installed the add-ons are unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Firefox Add-ons (AMO) affected ? fixed ?
- :Phantom wallet affected ? fixed ?
- :Jupiter wallet affected ? fixed ?
- :Bitget Wallet affected ? fixed ?

## How to check

Look in Firefox (about:addons, or enterprise extension inventory) for the AMO add-on IDs 3092199 (fake Phantom), 3092666 (fake Jupiter) and 3092059 (fake Bitget, manifest name 'TabFlow Pro'). Also look for any wallet add-on whose name uses homoglyphs or whose publisher is not the official one. In DNS and proxy logs, look for traffic to bonto[.]io or its subdomains (phantom., jupiter., bitget., coinbase., exodus.), including GET phantom[.]bonto[.]io/config. On-chain payout addresses: EVM 0x93ce11fAA9FC83741e8b392879b383bcc5f7f3Ad, SOL GCo8tAh5WjAuH51bnRZtkmKDRuoXHFDNz9MZY25Zuvsr, BTC bc1qrsfyjrsel924nny9q0qak5cfyf7pahmsydwnrq.

## Fix

Remove the add-ons and block bonto[.]io. Removing the add-on does not undo the theft: treat any seed phrase or private key typed into, imported into or shown in a browser with these add-ons as compromised. Create a new wallet with a new seed on a clean device and move the funds. Only install wallet extensions through the official link on the wallet vendor's site, and allow-list browser extensions on company machines.

## Timeline

- 2026-10-27T19:49:45+00:00 analyst

## Documents

- [describes] @SocketSecurity: Socket uncovered malicious Firefox extensions impersonating Phantom, Jupiter, an https://x.com/SocketSecurity/status/2115158901435896006
- [describes] Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets (Socket Threat Research) https://t.co/yaU2lZoR5d
- [discussion] @feross: A malicious Firefox wallet extension bundled server-review.js, which returns an  https://x.com/feross/status/2115184289088168154

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_