![\"Genuine](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/mt-fourblogs-oct30b27-wallet-phantom.png\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nPhantom, Jupiter, and Bitget were impersonated<\/h3>\n
Malicious Firefox add-ons copied the identities of three real cryptocurrency wallets: Phantom, Jupiter, and Bitget. The legitimate wallet providers are not the scammers.<\/p>\n
Socket’s researchers identified the extensions and analyzed their code. Their purpose was to capture recovery phrases and private keys, not provide trustworthy access to a wallet.<\/p>\n
The fake listings were removed by the time the research was published. That doesn’t make an earlier installation harmless or undo a secret already stolen.<\/p>\n
The target was the key to the wallet itself<\/h3>\n
A recovery phrase is a way to restore control of a wallet. Someone who obtains it can use it elsewhere, without needing your browser’s local password.<\/p>\n
That’s why entering a phrase into the wrong extension is more serious than creating an account on a dubious site. Removing the extension cannot revoke that knowledge.<\/p>\n
The reported code also targeted private keys. The important exposure is the secret itself, whether typed, pasted, or displayed where malicious code can read it.<\/p>\n
Recognize the campaign without accusing every wallet extension<\/h3>\n
The technical report identifies these numeric Firefox Add-ons listing IDs:<\/p>\n
- \n
- Phantom impersonator: 3092199.<\/li>\n
- Jupiter impersonator: 3092666.<\/li>\n
- Bitget impersonator: 3092059, with the internal name TabFlow Pro.<\/li>\n<\/ul>\n
Those listing identifiers are not a claim that every extension using one of these brands is malicious. Check the exact source, developer, and supported platform.<\/p>\n
Don’t import a wallet through these impersonators. If you exposed a recovery phrase or key, treat the wallet as compromised and act from a clean environment.<\/p>\n
Why an Official Store Didn’t Make These Extensions Safe<\/h2>\n
Finding an add-on in a familiar store can feel like an identity check. It isn’t the same as following a verified download link from the wallet provider.<\/p>\n
The fake listings borrowed recognizable names and branding. Socket describes lookalike characters in the Phantom name, making visual recognition especially unreliable.<\/p>\n
Read the full developer identity and installation route, not just the large title. A copied icon doesn’t tell you who published the code.<\/p>\n
Permissions matter too. Access to website data can enable an extension to interact with information on pages you visit. Consider whether the verified function justifies that access.<\/p>\n
But a permission prompt alone cannot distinguish every legitimate wallet from a fake. Some genuine software needs powerful access, so provenance remains essential.<\/p>\n
Use the provider’s actual website to reach its supported download. Don’t let a store search result become the only link connecting a familiar brand to unfamiliar code.<\/p>\n
How the Fake Firefox Wallet Extension Scam Works<\/h2>\n
Step 1: A lookalike listing borrows a trusted wallet identity<\/h3>\n
The extensions presented familiar wallet brands to people looking for a way to manage cryptocurrency. That puts the deception before the import screen even opens.<\/p>\n
You might think you’re installing an alternative browser version of a product you already know. The name supplies confidence that the publisher hasn’t earned.<\/p>\n
A real brand’s popularity doesn’t transfer to anyone who copies its graphics. Check whether that exact wallet currently supports Firefox and where its genuine downloads lead.<\/p>\n
Step 2: Installation gives the add-on access to browser activity<\/h3>\n
Once installed, the malicious code can operate inside the browser. Socket reports that the packages included code capable of collecting wallet secrets.<\/p>\n
The important risk isn’t limited to the first window you see. An extension can continue running while you move between tabs or reopen the browser.<\/p>\n
If you suspect an installed add-on, stop using that browser for sensitive activity. Don’t open another wallet there just to check whether it still works.<\/p>\n
Preserve the extension name and available details without revealing any recovery phrase. Investigating an installation should not create a second exposure.<\/p>\n
Step 3: A familiar import process exposes a recovery phrase<\/h3>\n
Restoring a wallet can involve entering secret words or a private key. A malicious imitation places the theft exactly where the user expects a legitimate import.<\/p>\n
Typing the words in separate boxes doesn’t make them safe. Pasting them instead of typing doesn’t solve the problem either.<\/p>\n
Socket reports capture from inputs and clipboard activity, with the Phantom variant also reading phrase-reveal screens. The interface’s appearance isn’t a protection against its own code.<\/p>\n
If you displayed a secret while the suspect extension was active, don’t dismiss the risk because you never pressed a button labeled \u201csubmit.\u201d<\/p>\n
Step 4: Stolen secrets are sent away from the browser<\/h3>\n
The report connects the extensions to brand-named subdomains under bonto[.]io. Those names are campaign indicators, not legitimate wallet support destinations.<\/p>\n
All three packages included stealing code. The Phantom impersonator additionally used a remote loader that could fetch another payload after installation.<\/p>\n
That distinction matters: removal from the store isn’t a rewind button, and an apparently quiet first run doesn’t establish that the package was safe.<\/p>\n
Don’t visit the reported infrastructure yourself or send test phrases. A security report provides enough reason to avoid the identified impersonators without recreating their collection process.<\/p>\n
Step 5: Possession of the secret enables control elsewhere<\/h3>\n
The thief doesn’t need to keep using your computer after obtaining a usable phrase or key. They can act through another wallet environment.<\/p>\n
This is why changing the extension’s unlock password isn’t a complete remedy. That password and the secret controlling the assets serve different purposes.<\/p>\n
A hardware wallet also isn’t a remedy for a seed already exposed. Importing that same seed into different hardware doesn’t make the secret unknown again.<\/p>\n
The response must address both sides: remove the malicious software and replace the compromised wallet’s control with a newly generated, securely held secret.<\/p>\n
What the Genuine Phantom Help Page Says<\/h2>\n
Phantom’s own support page says Firefox is no longer supported. Its update instructions refer users to supported browsers and explain that updates normally happen automatically.<\/p>\n
That is useful when a listing claims to be a Firefox update. Verify the supported platforms through the provider, not through the listing selling you that claim.<\/p>\n
It doesn’t mean every historical Phantom Firefox installation was a criminal impersonation. Unsupported software and a specifically identified malicious package are different findings.<\/p>\n
![\"Official](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/mt-fourblogs-oct30b27-wallet-firefox-note.png\" "\\"\\"")
<\/figure>\nThe genuine support article<\/a> also warns that support will never request your recovery phrase or private key.<\/p>\n
Keep that boundary even when seeking help after a theft. A person who asks you to disclose the secret is creating another risk, not fixing the first.<\/p>\n
A Connected Website Is Different From an Exposed Recovery Phrase<\/h2>\n
Work out what you actually shared before choosing a remedy. A public wallet address is designed to be shared; it isn’t a recovery phrase.<\/p>\n
Don’t post the secret words alongside that address when asking whether an account is affected. Public transaction information is enough to start describing the problem.<\/p>\n
Connecting a genuine wallet to a website, signing a transaction, and importing its seed into unfamiliar software are different actions. Record which one occurred.<\/p>\n
Disconnecting a website addresses a connection. It cannot make a copied recovery phrase private again or change the keys derived from that phrase.<\/p>\n
Similarly, revoking a token approval is not a replacement for moving away from an exposed seed. Don’t accept that single action as proof of complete recovery.<\/p>\n
If you only viewed the store listing, don’t assume that reading it disclosed your wallet. The reported theft required malicious code and access to secrets.<\/p>\n
If you installed the add-on and later revealed a phrase elsewhere in that browser, include that in your exposure assessment, even without a direct import.<\/p>\n
This isn’t about blaming yourself for an ordinary-looking screen. It’s about matching the next action to the information that may now be outside your control.<\/p>\n
What to Do If You Installed a Fake Wallet Extension<\/h2>\n
- \n
- \n
Stop sensitive activity in the affected browser.<\/strong> Don’t import another wallet, reveal a phrase, or sign financial transactions there while you assess the installation.<\/p>\n
Use a separate, trusted device for urgent wallet protection. Avoid installing a replacement from the same search results that led you to the suspect add-on.<\/p>\n<\/li>\n
- \n
Record what was installed without exposing secrets.<\/strong> Note the displayed name, developer, version, and installation source if available.<\/p>\n
Firefox’s numeric store listing ID may differ from identifiers shown in browser troubleshooting information. Preserve what you see rather than guessing that the numbers must match.<\/p>\n<\/li>\n
- \n
Remove the impersonator from Firefox.<\/strong> Open the menu, choose Add-ons and themes<\/strong>, then Extensions<\/strong>. Find the suspect entry and choose its three-dot menu, then Remove<\/strong>.<\/p>\n
Follow Mozilla’s extension-removal instructions<\/a> if menu wording differs. Confirm the entry is gone before returning to normal browsing.<\/p>\n<\/li>\n
- \n
If a phrase or key was exposed, create a genuinely new wallet.<\/strong> Use trusted software on a clean device and generate a new recovery phrase.<\/p>\n
Don’t reuse the compromised words. Don’t store the new phrase in the affected browser, email it to yourself, or send it to someone claiming to assist.<\/p>\n<\/li>\n
- \n
Protect remaining assets with the genuine provider’s guidance.<\/strong> Check which accounts and networks depend on the exposed secret before assuming only the visible balance matters.<\/p>\n
Moving assets may require network fees and careful address checks. Don’t repeatedly add funds to an address that appears to be drained automatically; seek verified help.<\/p>\n<\/li>\n
- \n
Check for additional unwanted software.<\/strong> Update the browser and use a reputable scanner appropriate to your operating system if you suspect wider exposure.<\/p>\n
On Windows, use Malwarebytes for Windows<\/a>. Mac users should use the separate Malwarebytes for Mac<\/a> route.<\/p>\n
A clean scan doesn’t invalidate a stolen phrase. Deal with wallet control even if no additional malware is detected.<\/p>\n
AdGuard can be optional protection against unwanted advertising afterward. It cannot authenticate a wallet extension or restore a secret that has escaped.<\/p>\n<\/li>\n
- \n
Save transaction evidence if funds moved.<\/strong> Record public receiving addresses, asset names, amounts, networks, timestamps, and transaction hashes.<\/p>\n
Report suspected theft through the appropriate authorities, including IC3<\/a> for relevant US reports. Never include your recovery phrase or private key in a report.<\/p>\n<\/li>\n
- \n
Reject rescue contacts that ask for secrets or advance payments.<\/strong> A reply under a public complaint may be another impersonator looking for worried wallet owners.<\/p>\n
Find support through the wallet provider’s genuine website. Don’t hand over remote access or sign an unexplained transaction because someone claims they can reverse the theft.<\/p>\n<\/li>\n<\/ol>\n
If the Extension Won’t Stay Removed<\/h2>\n
First check that you’re looking at the same Firefox profile. Removing an add-on from one profile doesn’t describe what’s installed in another.<\/p>\n
If it reappears, don’t keep importing the wallet to see whether the problem is fixed. Keep sensitive work on the separate trusted device.<\/p>\n
Record any message preventing removal. A managed device may require help from its administrator, while an unexpected management restriction on a personal device needs closer investigation.<\/p>\n
Don’t delete random browser folders or scheduled tasks. This campaign’s documented Firefox extensions don’t justify a blanket cleanup of unrelated Windows files.<\/p>\n
If you’re unsure, ask for help in the MalwareTips malware-removal forum<\/a>. Share the extension details, not wallet secrets.<\/p>\n
Ad Blocking Helps With Some Routes, Not With a Leaked Key<\/h2>\n
- \n
- \n