Fake Firefox Extensions Masquerade as Phantom, Jupiter, and Bitget to Steal Crypto Wallet Keys

Three malicious Firefox extensions impersonated popular crypto wallets Phantom, Jupiter, and Bitget to capture users’ recovery phrases and private keys.

Whoever obtains those secrets gains control of the wallet and its funds. All three listings were present in the Firefox Add-ons store while researchers examined them and have since been removed.

The fraudulent extensions copied wallet names, icons, and marketing text used by legitimate wallets, making it easy for someone searching the store to install a fake by mistake. This technique matches other fake wallet screens used to trick users into revealing secrets.

Socket.dev researchers discovered the malware and published their findings on October 27, 2026. They found that the extensions exfiltrated harvested secrets to subdomains of a command-and-control domain, bonto[.]io.

The Phantom impersonator also included a hidden loader capable of changing behavior after Mozilla approved the add-on.

Malicious Firefox extensions impersonate Phantom, Jupiter, and Bitget

The Phantom listing used lookalike Unicode characters in its name so it displayed as “Phantom.” It reused Phantom’s ghost icon and presented itself as “Official Phantom Wallet (Firefox Update).”

The Jupiter fake claimed to be built by Jupiter Exchange. The Bitget fake used the internal name “TabFlow Pro” but presented Bitget branding to users. None of the three provided a privacy policy, and all falsely declared they collect no data.

The Phantom package contained a small loader in its background script. The loader concealed the server address inside a list of numbers and then fetched a settings file from phantom[.]bonto[.]io.

The settings file instructed the extension whether to activate and included a base64-encoded stealer. That code executed on every page the victim opened, allowing it to read objects on wallet pages.

Because the operator controlled the server, it could return a benign response during Mozilla’s review and deliver the real stealer afterward.

The stealer monitored for 12-, 15-, 18-, and 24-word recovery phrases and for Ethereum and Solana private-key formats. It read text fields, paste events, and the numbered phrase grid wallets display on the secret-phrase screen.

Captured data was sent to the attacker’s server as JSON. Socket previously reported similar thefts, including 16 malicious Firefox extensions that mimicked Rabby and OKX wallet screens earlier in the month.

The Jupiter and Bitget fakes were simpler: each bundled a stealer inside the extension package and sent discovered recovery phrases directly to jupiter[.]bonto[.]io or bitget[.]bonto[.]io.

The Jupiter fake also requested access to Trezor Connect, expanding the data it could read. Socket observed that all three packages contained a full, always-on stealer embedded in the signed code Mozilla reviewed, so the remote loader in Phantom was an additional layer rather than the only payload.

Hidden infrastructure and real-world risk

The Phantom package also included the operator’s drainer backend: a Node.js file named server.js.

That backend saved stolen secrets to local files, forwarded them to a Telegram bot, and moved funds to fixed payout addresses on multiple chains, including Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana, and Bitcoin.

A code comment indicated the payload would activate only “after approval flip,” meaning after the add-on passed review. A companion file, server-review.js, returned an inactive response during review.

All exfiltration servers were hosted behind Cloudflare, masking the true origin. Socket also found active subdomains coinbase[.]bonto[.]io and exodus[.]bonto[.]io, suggesting plans to impersonate Coinbase Wallet and Exodus as well, although no matching store listings were identified.

Each fake add-on originated from a separate throwaway developer account, which slows bulk takedown efforts.

Phantom and Jupiter packages included a CLAUDE.md file — an AI jailbreak prompt that was never executed. Socket interprets this as evidence of AI-assisted malware development and an attempt to evade AI-based review systems.

The campaign also attempted to manipulate its reputation. Over roughly two days the Phantom listing’s reviews rose from 275 to 546 and its rating climbed from 2.9 to 3.9, which suppressed some one-star reports from users claiming lost funds (those loss claims are unverified). The listings had only one to three daily users, but their servers were active.

Socket characterizes the group as a repeat offender, similar to the earlier Offside Wallet Theft Factory campaign that was tied to 77 Firefox add-ons.

Recommendations: install browser extensions only via links on the wallet maker’s official website, not by searching the store. No legitimate wallet will ever ask you to enter your recovery phrase on a webpage.

If you entered a recovery phrase or private key into one of these add-ons, create a new wallet on a clean device immediately and transfer your funds. Removing the extension does not make a leaked phrase safe.

Security teams should block bonto[.]io and its subdomains and hunt for extensions that fetch settings and then execute the returned content as code. Browser add-ons are not the only threat to wallets; other campaigns such as Odyssey Stealer target wallet data on desktops.

Indicators of compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate Threat Intel from 16K SOCs.