16 Fake Firefox Extensions Stole Crypto Recovery Phrases

Researchers found 16 malicious Firefox extensions impersonating Rabby and OKX Wallet tools. These extensions intercepted recovery phrases and private keys, sending them to attacker-controlled Cloudflare Workers. Four extensions mimicked Rabby Wallet, while the rest targeted OKX Wallet. All but one contacted the domain ‘*.icy-star-f45c.workers[.]dev’. The activity is part of an ongoing campaign with rotating package names and reused infrastructure. All extensions were removed by October 5, 2026. Users who entered real recovery phrases should assume compromise and create new wallets.