16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases: The Hacker News Research

Executive Summary

According to security intelligence published by The Hacker News, Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases and private keys.

"The extensions masquerade as wallet portals, desktop utilities, and browser tools, but their code intercepts recovery phrases and private keys during wallet import flows and attempts to send those secrets to attacker-controlled Cloudflare Workers," Socket researcher Joseph Edwards said in an analysis.

Four of these extensions are clones of Rabby Wallet, while the rest are targeted clones of OKX Wallet. All the identified add-ons barring one have been found to contact the "*.icy-star-f45c.workers[.]dev" domain. The end goal is to collect mnemonic phrases and private keys and exfiltrate them to the Cloudflare Workers domain.

Technical Context

Security advisories and threat research published by The Hacker News highlight the importance of auditing distributed microservices, validating automated integrations, and eliminating unintended public service exposures.

Key Considerations for Infrastructure Teams

• Service Discovery & Exposure Audits: Continuously scan internet-facing assets and microservices to detect unintended public exposure.
• Authentication & Protocol Hardening: Enforce strict mutual TLS (mTLS) or robust token-based authentication on all management interfaces.
• Vulnerability Lifecycle Management: Maintain automated dependency tracking and rapid patching protocols for third-party protocols and libraries.

Recommended Mitigation Steps

1. Review internal systems and endpoints matching the advisory scope disclosed by The Hacker News.
2. Restrict external network access and implement least-privilege network controls for background services.
3. Conduct deep endpoint audits using automated testing tooling to verify secure handshake and header configurations.

Editorial Notice: This bulletin is an independent editorial summary based on reporting and disclosures published by The Hacker News. CertificateGuardian curates industry intelligence to assist infrastructure teams in securing web endpoints.