firefox

According to a report by Decrypt, security company Socket released research results linking 77 Firefox extensions to what it calls a "wallet theft factory," with 40 confirmed to have malicious behavior.These extensions disguise themselves as Web3 products like OKX, Rabby Wallet, and TronLink, tricking users into importing wallets through fake wallet interfaces or using modified real wallet code to steal mnemonic phrases and private keys as users input them. Mozilla's signature records show that this activity lasted from March 9 to August 3, and multiple extensions were still online at the time of Socket's report.About half of the extensions displayed realistic wallet interfaces and prompted users to import existing wallets, thereby intercepting the inputted mnemonic phrases or private keys; another 13 were modified versions of Rabby that sent account data stored in wallets to external servers while functioning normally; and 5 specifically collected saved credentials and clipboard content.Additionally, 37 extensions disguised themselves as password generators, dark mode toggles, VPNs, currency converters, and note-taking tools, but actually ran sports score applications sharing the same hardcoded credentials. Nine confirmed malicious extensions were initially released as score applications for sports like football and basketball, with subsequent updates replacing them with wallet theft code.Socket named this activity the "wallet theft factory," but cautioned that it has not confirmed whether all extensions are controlled by the same operator. The Socket team stated that any user who has entered mnemonic phrases or private keys into these extensions should consider it a "permanent leak" and immediately transfer funds to a new wallet, as uninstalling the extensions cannot undo the mnemonic phrases sent elsewhere.

According to Decrypt, Mozilla recently revealed that Anthropic's latest AI model, Claude Mythos, identified 271 security vulnerabilities during internal testing of the Firefox browser, and the related vulnerabilities have been fixed this week.In comparison, a previous version of the Anthropic model only found 22 security-sensitive vulnerabilities. Mozilla stated that all discovered vulnerabilities were within the scope of top human researchers' findings. Claude Mythos was officially released in March 2026 and is Anthropic's most powerful model in the fields of reasoning, coding, and cybersecurity, currently available for use by vetted partners such as Amazon, Apple, and Microsoft through the "Project Glasswing" initiative.

ChainCatcher message, Slow Mist Technology's Chief Information Security Officer 23pds tweeted that the security company Koi disclosed over 40 counterfeit cryptocurrency wallet extensions in the official Firefox browser add-on store, imitating mainstream wallets such as MetaMask and Coinbase Wallet. These malicious plugins steal mnemonic phrases by embedding event listener code and send the data back to the attacker's server.

According to ChainCatcher, BleepingComputer reports that over 40 malicious extensions have been found in the official Firefox extension store, impersonating well-known cryptocurrency wallets, including fake versions of Coinbase, MetaMask, Trust Wallet, Phantom, Exodus, OKX, Keplr, and MyMonero.Security company Koi Security's research found that these malicious extensions monitor user input to steal wallet recovery phrases and private keys, transmitting the data to servers controlled by the attackers. Many of the extensions are cloned versions of legitimate open-source wallets but have added malicious code. Attackers establish trust by using real brand logos and a large number of fake five-star reviews.

ChainCatcher news, according to Cointelegraph, OKX has issued a warning to users that a fraudulent OKX browser extension has appeared in the Firefox browser plugin store. The extension integrates third-party features within the web browser interface.According to OKX, the company has not released any Firefox browser plugins and advises users who mistakenly downloaded the plugin to transfer any funds from wallets associated with the fraudulent extension.OKX has contacted Firefox to remove these applications and reminds users to never download OKX-specific software from third parties.