What happened
Cybersecurity researchers have identified a group of sixteen malicious Mozilla Firefox extensions that impersonate legitimate wallet portals, desktop utilities, and browser tools. These malicious extensions are able to intercept recovery phrases and private keys during wallet import processes. The captured sensitive information is then transmitted to external endpoints, posing a significant risk of theft of cryptocurrency assets. Although there is no evidence of widespread exploitation or zero-day vulnerabilities, the potential impact on affected users remains substantial.
Who is affected
Organizations running Mozilla Firefox browser with any of the identified malicious extensions installed are at risk. The threat is applicable to all users who may have inadvertently installed these extensions, as they conceal their malicious intent by masquerading as legitimate wallet and utility tools. Specifically, entities managing cryptocurrency wallets or engaging in digital asset transactions may face the compromise of their recovery phrases and private keys, leading to potential financial loss.
Recommended actions
- Review and audit installed Firefox extensions to identify any that resemble or are similar to wallet portals, desktop utilities, or browser tools, especially those not obtained from official sources.
- Immediately remove any extensions suspected of being malicious or that are unfamiliar and have not been verified as legitimate.
- Ensure that all extensions are obtained exclusively from trusted sources and verified before installation.
- Implement browser security policies where feasible to restrict installation of unverified extensions.
- Regularly monitor network traffic for unusual outgoing connections that may indicate data exfiltration efforts related to the malicious extensions.
Indicators of compromise
None provided at this time.
