Skip to content
Today
Sections

Build Independently confirmed2 publishers 3 min read Published Updated

Sixteen Firefox extensions cloned Rabby and OKX wallets to capture seed phrases at import

Socket found 16 Firefox extensions posing as Rabby and OKX wallets that intercept recovery phrases and private keys during wallet import. Names and IDs rotated behind a screen that still read Rabby Wallet, so only an allowlist of exact extension IDs holds up.

The Engineer · Build desk

Send a correction

Illustration accompanying Sixteen Firefox extensions cloned Rabby and OKX wallets to capture seed phrases at import
Generated illustration

What happened

  • Four of the extensions repackage Rabby Wallet as "Raabby WaIIet" and send the raw seed or private key to a Cloudflare Worker in GET query parameters.
  • Eleven of the twelve OKX Wallet clones run a background script that takes a 12- or 24-word phrase and forwards it to a Cloudflare Worker.
  • Every manifest declared Firefox's data collection permission as none, although the code handles and transmits wallet recovery material.
  • Mozilla had unpublished the malicious extensions as of October 5, according to Socket.

Why it matters

  • What it limits constraint Screening wallet extensions by name cannot catch this campaign, so teams that allow browser wallets need an allowlist pinned to the exact extension ID they approved.
  • What it limits constraint Firefox's self-declared data collection field is no longer a usable screening signal for wallet extensions after all 16 packages set it falsely.
  • What it costs cost Victims carry the whole recovery cost: a new wallet built in a clean environment and every asset moved, whatever Mozilla does with the listings.
  • What it sets up precedent With Socket linking this batch to its August 2026 findings, the October takedown is one round in a recurring campaign, and the reused icy-star-f45c host is the indicator to block.

Socket describes the Rabby clones as complete wallet applications. Each package holds 1,114 files and a Webpack build tagged webpackChunkrabby, with Rabby's locale material, keyring code, import screens and transaction UI [11]. Links to Rabby's official Chrome Web Store listing, its legal pages and its mobile apps survive in the clone [17]. Interception happens at one step, when a user enters a recovery phrase or private key into an import screen [1].

Its rebrand is uneven. On the onboarding screen it still says "Rabby Wallet", while the document title says Raabby WaIIet and the manifest lists the author as Debrunk [16]. That fake name adds an a to Rabby and puts capital I's where Wallet has l's, across index.html, desktop.html, locale names and document titles [15]. The operators applied their typo more consistently than anything else in the package, and Socket says that consistency gives defenders a static detection string [15].

A check on the name fails for both user and reviewer. A user sees "Rabby Wallet" on the first screen [16]. Someone reviewing the listing has to spot one extra letter and two swapped glyphs [15]. Between uploads, the operators rotate package names, versions, extension IDs, descriptions and presentation, while reusing the same interfaces, credential-handling logic, campaign marker and servers [6].

Publisher identity is where the clones stop matching. The 16 IDs sit under nine domains, including webtools.co, browserweb.com and plugify.example [20]. A blocklist of those domains would need an update at each new upload. I think the control that holds up is an allowlist: the managed browser installs the exact extension ID a team approved for its wallet and refuses everything else. It depends on the team recording the vendor's real extension ID at the moment it approves the wallet.

Socket splits the OKX family into three background-script variants, and one never worked [13]. The package sipoo-grozza@browserweb.com carries exfiltration code, but its manifest does not load background.js, and its frontend sends SEED_PHRASE_IMPORT while the background handles only WALLET_SYNC [4]. It also reports to a different host, fondationanimalaidrelief[.]workers[.]dev. The other 15 contact icy-star-f45c[.]workers[.]dev [5]. So 15 working stealers shared one exfiltration host [19].

Citing reused infrastructure, tactics and targeted lures, Socket wrote: "we assess with high confidence that this campaign is a continuation of crypto-theft targeted extensions Socket identified in August 2026" [7].

Both impersonated wallets are large. Socket puts Rabby at 900,000 Chrome Web Store users and 500,000 Google Play downloads, and OKX at more than 1,000,000 Chrome Web Store users [18]. For anyone who typed a real phrase into a working variant, Socket's note is direct: "Changing only the extension password does not revoke a stolen seed phrase or private key" [10].

What to watch

  • New Raabby WaIIet or OKX lookalikes appearing on Firefox under fresh IDs that still call icy-star-f45c[.]workers[.]dev.
  • Any change by Mozilla to how it checks the self-declared data collection permission on extensions that handle wallet secrets.
  • Rabby or OKX publishing their genuine Firefox extension IDs so administrators can pin an allowlist to them.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence70
Adoption
Not scored
Hype gap+5
Incentives40
Confidence65
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Socket Threat Research identified a coordinated campaign of 16 Firefox extensions targeting cryptocurrency wallet users; their code intercepts recovery phrases and private keys during wallet import flows and attempts to send those secrets to attacker-controlled Cloudflare Workers.

    Reported Supported Source: Socket Threat Research (Joseph Edwards)View cited source
  2. [2]

    Four large extensions are clones of Rabby Wallet that impersonate it as 'Raabby WaIIet', hook mnemonic and private-key import paths, and send the raw secret to a Cloudflare Worker using GET query parameters.

    Reported Supported Source: SocketView cited source
  3. [3]

    Twelve smaller extensions are clones of OKX Wallet; eleven register a background script that receives a 12- or 24-word phrase and sends it to a Cloudflare Worker.

    Reported Supported Source: SocketView cited source
  4. [4]

    One OKX variant, sipoo-grozza@browserweb.com, packages exfiltration code but is broken as shipped: its manifest does not load background.js, and its frontend sends SEED_PHRASE_IMPORT while the packaged background handles only WALLET_SYNC.

    Reported Supported Source: SocketView cited source
  5. [5]

    Fifteen of the extensions contact icy-star-f45c[.]workers[.]dev; the broken variant uses fondationanimalaidrelief[.]workers[.]dev but retains the same frontend and campaign marker.

    Reported Supported Source: SocketView cited source
  6. [6]

    The operators rotate package names, versions, extension IDs, descriptions, and presentation while reusing the same wallet interfaces, credential-handling logic, campaign marker, and network infrastructure.

    Reported Supported Source: SocketView cited source
  7. [7]

    we assess with high confidence that this campaign is a continuation of crypto-theft targeted extensions Socket identified in August 2026

    Reported Supported Source: Socket, citing reused infrastructure, tactics and targeted luresView cited source
  8. [8]

    As of October 5th, Mozilla has unpublished the malicious extensions.

    Reported Supported Source: SocketView cited source
  9. [9]

    Any user who entered a real recovery phrase or private key into any functioning variant should treat the wallet as compromised, create a new wallet from a clean environment and move assets immediately.

    Reported Supported Source: SocketView cited source
  10. [10]

    Changing only the extension password does not revoke a stolen seed phrase or private key.

    Reported Supported Source: SocketView cited source
  11. [11]

    The four Rabby-clone packages are repackaged wallet applications; each contains 1,114 files and a Webpack application with webpackChunkrabby, Rabby locale material, wallet keyring code, import screens, and transaction UI.

    Reported Supported Source: SocketView cited source
  12. [12]

    Affected extension IDs: view-focus-bright@webtools.co, quick-track-nest@tabtools.co, vibe-kit-tool@fasttools.co, edge-hub-snap@protools.net, core-hub-peak@neattools.example, sipoo-grozza@browserweb.com, mozart-seo@webtools.com, clean-file-bar@neattools.com, clean-net-timer@plugify.example, manager-square@webtools.com, manager-course@webtools.com, val-andrew@browserweb.com, manager-team@browserweb.com, valory-andrew@browserweb.com, franklin-uk@browserweb.com, franklin-uro@browserweb.com.

    Reported Supported Source: Socket affected-extensions listView cited source
  13. [13]

    Reuse separates the extensions into a large Rabby wallet clone family and an OKX wallet-phishing family with three background-script variants.

    Reported Supported Source: SocketView cited source
  14. [14]

    Every manifest declares Firefox data collection permission 'none', contradicting the code that handles and transmits wallet recovery material.

    Reported Supported Source: SocketView cited source
  15. [15]

    The Rabby clones' branding is altered to 'Raabby WaIIet' (an extra a in Rabby, capital I characters in place of the l's in Wallet) across index.html, desktop.html, locale names, document titles and selected strings; Socket says the misspelling is consistent and provides a useful static detection string.

    Reported Supported Source: Socket; character observation from the quoted stringView cited source
  16. [16]

    In the Rabby clones the rendered onboarding screen says 'Rabby Wallet,' the document title says Raabby WaIIet, and the manifest identifies the author as Debrunk.

    Reported Supported Source: SocketView cited source
  17. [17]

    The clone preserves links to Rabby's official Chrome Web Store listing, Rabby legal pages, and Rabby mobile applications in the Apple App Store and Google Play.

    Reported Supported Source: SocketView cited source
  18. [18]

    Rabby Wallet has 900,000 users on the Chrome Web Store and 500,000 downloads on Google Play; OKX Wallet has over 1,000,000 users on the Chrome Web Store.

    Reported Supported Source: SocketView cited source
  19. [19]

    15 of the 16 extensions were functioning stealers, and all 15 contacted icy-star-f45c[.]workers[.]dev.

    Derived Supported
  20. [20]

    The 16 malicious extension IDs use nine distinct domains.

    Derived Supported

Sources

2 independent publishers whose own reporting we read for this story.

  1. socket.dev

    1 article · October 7, 2026

    16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials
  2. thehackernews.com

    1 article · October 8, 2026

    16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases

Topics and entities

Topics

Entities