Firefox users are now being targeted by malicious extensions posing as popular crypto wallets—Phantom, Jupiter, and Bitget. These impostors mimic official listings in name, icon, and description to steal users’ recovery phrases and private keys. All three were live in the Firefox Add-ons store—until researchers uncovered the fraud and they were removed. Any user typing in wallet secrets risks losing all coins in that wallet.
How the Deception Worked
Security analysts at Socket.dev shook the alarm on October 27, 2026, after finding that the fake add-ons send stolen secrets to subdomains of bonto[.]io, the command-and-control domain steering the attack. One of the Phantom fakes included a secret loader component: it appeared benign during Mozilla’s review but could activate hidden malicious behavior later through instructions fetched from a remote server. The others—Jupiter and Bitget impostors—bundled the data-stealing code directly in the submitted package.
To fool users, the Phantom copy even used lookalike Unicode characters so its name visually matched the real Phantom. It displayed the same ghost logo and called itself “Official Phantom Wallet (Firefox Update).” Jupiter’s fake claimed to be made by Jupiter Exchange, while Bitget’s used a different internal name—“TabFlow Pro”—but showed Bitget branding. None of them had privacy policies, and all claimed not to collect data.
Stealing Mechanisms & Risks
The Phantom imposter went deeper: after installation, it pulled settings from phantom[.]bonto[.]io that told it to run a base64-encoded stealer. Once active, it spied on every browser page—tracking recovery phrases, Ethereum and Solana private keys, and reading user input including paste events. Jupiter and Bitget fakes, meanwhile, directly sent the secrets to their respective subdomains.
Even more alarming: the Phantom fake included server-side “drainer” code (back-end infrastructure) to save the stolen data locally, send it through a Telegram bot, and automatically transfer funds from compromised wallets on networks like Ethereum, Solana, BSC, Polygon, Avalanche, Optimism, and Base. Its code also contained a “server-review.js” file designed to remain dormant during Mozilla review but enable full malicious behavior afterward.
Indicators & Best Practices
Some useful indicators of this scheme: all exfiltration traffic goes through subdomains like phantom[.]bonto[.]io, jupiter[.]bonto[.]io, bitget[.]bonto[.]io; IPs involved include 104.21.34.69 and 172.67.155.198. The attackers also appear to have plans to impersonate Coinbase and Exodus wallets based on reserved domains. Each fake came from a throwaway developer account, complicating removal efforts. These packages rode off temporary reputation over a couple of days—boosting reviews and ratings to bury user complaints about fund losses.
To stay safe, users should stick to installing wallet extensions via official sites—not by searching the add-ons store. True wallets will never request recovery phrases through a browser webpage. If exposure has already occurred, victims are advised to set up a new wallet from a secure, clean device and transfer funds immediately. Security teams should block the bonto[.]io domain and monitor for extensions that fetch remote code or run code dynamically after installation.
What this tells us: the attack reveals growing sophistication in crypto-targeted malware via browser extension ecosystems. False branding, deferred payload delivery, and AI-shaped code shows attackers can evade store reviews. Stricter validation of wallet extensions, domain reputation checks, and user education are no longer optional—they’re essential tools to protect digital assets.
