Fake Wallet Extensions on Firefox Target Crypto Users

A Russian-speaking hacker group has deployed over 40 fake crypto wallet extensions on Firefox since at least April 2025. These malicious plug-ins target mainstream wallets such as MetaMask and Coinbase Wallet.

The impersonation of wallet brands on Firefox exposes users to credential theft, posing significant risks for crypto holders. Despite evident malicious activity, numerous fake extensions remain downloadable, challenging automated detection systems.

Over 40 Fake Wallet Extensions Identified on Firefox

Security company Koi Security identified over 40 fraudulent crypto wallet extensions on Firefox, targeting recognized wallet platforms like MetaMask. Implications for crypto users include potential theft of mnemonic phrases, giving hackers access to associated assets. Though some user reviews have exposed these scams, the download volumes remain unusually high. The hacker’s method involves mimicking legitimate brands and boosting credibility through fake five-star reviews. Mozilla acknowledges the challenge in removing these fraudulent extensions due to high volumes overwhelming their automated systems.

There is currently no comment from major leaders in the crypto industry or Mozilla regarding these incidents. However, Mozilla elaborated on its blog the human review process once fraud is flagged. The attack primarily involves the theft of mnemonic phrases, which can facilitate unauthorized access to wallets. Victims may face irreversible asset loss due to such breaches.

“If a wallet extension reaches a certain risk threshold, human reviewers are alerted to take a deeper look. If found to be malicious, the scam extensions are blocked immediately.” – Mozilla

Crypto Security at Risk Amidst Hacker Infiltration

Did you know? Similar fake wallet extension attacks in past years resulted in losses exceeding millions, underscoring a continuous threat to crypto safety.

According to CoinMarketCap, Ethereum (ETH) trades at $2,496.08, with a market cap of $301.32 billion. The asset shows a consistent 40.66% rise over 90 days, despite the recent 11.55% dip in trading volume. Market trends indicate increasing volatility impacted by high-profile security breaches.

Experts suggest the ongoing infiltration by hackers could pressurize digital asset regulations and security enhancements across platforms. Verifying extension sources remains vital in maintaining crypto asset safety.