Sixteen counterfeit browser extensions masquerading as legitimate cryptocurrency wallets sat inside Mozilla's Firefox Add-ons marketplace long enough to put an unknown number of users at serious risk. The discovery, made by supply-chain security firm Socket, centers on fake versions of Rabby Wallet and OKX Wallet — two widely used non-custodial crypto wallets — and it underscores a threat vector that the industry has struggled to contain: the counterfeit extension ecosystem hiding in plain sight on mainstream browser platforms.
Mozilla moved to unpublish all 16 malicious add-ons by October 5, acting on Socket's disclosure. That response, while relatively prompt, arrives too late for any user who installed one of the fake extensions and entered their wallet's recovery phrase. And this is the crux of the problem that tends to get buried beneath the headline of "malware removed": removal of a malicious extension does not undo the damage. If a seed phrase — the 12- or 24-word master key that controls permanent access to a wallet — was captured and transmitted to an attacker, that wallet is compromised indefinitely. Wiping the extension from a browser changes nothing about the attacker's ability to drain those funds at a time of their choosing.
The Anatomy of a Fake Extension Attack
Fake wallet extensions are among the most predatory tools in a crypto attacker's kit precisely because they exploit trust at the moment users feel most secure: inside a recognized, vetted marketplace. Firefox's Add-ons portal, like Chrome's Web Store, carries an implicit endorsement in the minds of ordinary users. Listing there does not require the level of code scrutiny most users assume it does, and bad actors exploit that assumption systematically. In this case, the attackers replicated the branding and user-interface elements of both Rabby and OKX Wallet with enough fidelity to deceive users into treating them as genuine products.
The attack pattern is straightforward and devastatingly effective. A user searches for a wallet extension, encounters what appears to be a legitimate listing, installs it, and is then prompted — as all wallet extensions legitimately are — to either create a new wallet or import an existing one via recovery phrase. At that moment of import, the malicious extension harvests the seed phrase and exfiltrates it to infrastructure controlled by the attacker. The user sees a functioning wallet interface. Nothing appears wrong. The attacker now owns those funds.
Why Rabby and OKX Were Targeted
The choice of Rabby and OKX Wallet as impersonation targets is not arbitrary. Rabby, developed by the DeBank team, has grown into one of the most trusted wallets among decentralized finance (DeFi) power users for its transaction simulation and security-focused features. OKX Wallet, meanwhile, is the self-custody product of one of the world's largest centralized exchanges by volume, giving it a massive and diverse user base that spans both retail and institutional participants. Targeting these two wallets means targeting users who are likely to have significant assets under management — not casual experimenters holding trivial sums.
This calculus is central to understanding the economics of fake extension campaigns. Attackers are rational actors optimizing for return. High-value wallet brands attract higher-value targets, and the marginal cost of publishing a convincing fake on a browser marketplace is negligible compared to the potential upside of a single successful seed phrase capture from an active DeFi trader.
The Limits of Platform Takedowns
Mozilla's October 5 removal of all 16 extensions is the appropriate response — but it should not be mistaken for a resolution. Platform-level takedowns are a containment measure, not a remediation. The security question that matters now is how many users installed these extensions before the unpublishing, and of those, how many entered recovery phrases. Neither Mozilla nor Socket has published those figures publicly, and by the nature of the attack, affected users may have no awareness that anything went wrong.
The broader infrastructure problem is one of discovery latency. Malicious extensions often persist for weeks or months before detection, during which time the damage accumulates silently. Socket's identification of 16 distinct fake add-ons suggests a coordinated campaign rather than opportunistic one-off fraud — the kind of operation that likely involves testing, iteration, and possibly rotating infrastructure to evade automated detection systems.
What Users Must Do Now
For anyone who installed a Rabby or OKX Wallet extension from Firefox's marketplace in recent months and used it to import an existing wallet, the guidance is unambiguous: treat that wallet as compromised. Move all assets immediately to a wallet generated on a verified, clean device using a new seed phrase. Do not wait to see if funds disappear — by the time an attacker moves assets, it is already too late to intervene.
The episode is also a reminder that wallet security hygiene requires sourcing extensions exclusively from official developer websites and verifying publisher details with a high degree of skepticism. Browser marketplaces are a convenience layer, not a security guarantee. In an asset class where custody is personal responsibility, the counterfeit extension problem is not a platform failure that users can simply wait for companies to solve. It is a permanent threat landscape that demands permanent vigilance.
Written by the editorial team — independent journalism powered by Bitcoin News.