Four of the fake wallets were the real wallet's code with the import function hooked
2026-10-09Security
Socket found sixteen Firefox extensions impersonating crypto wallets. Four were built from Rabby Wallet's actual codebase with the recovery-phrase import hooked to send secrets out; twelve were lighter copies of an OKX-styled interface. Both sets exfiltrated to Cloudflare Workers, and Mozilla has unpublished all sixteen.