--- title: Malicious Firefox Extensions Impersonate Phantom,... description: Three Firefox extensions impersonating the Phantom, Jupiter, and Bitget crypto wallets were caught stealing recovery phrases and private keys. Using Unicode... canonical: https://daily.dev/posts/malicious-firefox-extensions-impersonate-phantom-jupiter-and-bitget-to-steal-wallet-secrets-cwxhzvfpd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets | daily.dev og:description: Three Firefox extensions impersonating the Phantom, Jupiter, and Bitget crypto wallets were caught stealing recovery phrases and private keys. Using Unicode... og:url: https://daily.dev/posts/malicious-firefox-extensions-impersonate-phantom-jupiter-and-bitget-to-steal-wallet-secrets-cwxhzvfpd og:image: https://api.daily.dev/og/posts/CWXHZvfPd.png og:image:alt: Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets **[Socket](https://daily.dev/sources/socketdev)** · 11 min read · 0 upvotes · 0 comments ## Summary Three Firefox extensions impersonating the Phantom, Jupiter, and Bitget crypto wallets were caught stealing recovery phrases and private keys. Using Unicode homoglyphs to mimic the real brand names, the extensions sent stolen secrets to subdomains of a single command-and-control domain, bonto[.]io. The Phantom version went further, fetching a second-stage payload at runtime so it could stay inert during Mozilla's review and activate afterward. Phantom's package also bundled a full Node.js drainer backend that auto-swept funds across nine blockchains and logged secrets to a Telegram bot. All three listings were live on Firefox Add-ons and have since been removed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the malicious Phantom Firefox extension bypass Mozilla's review process? It shipped a small loader that fetched a second-stage stealer at runtime from phantom[.]bonto[.]io/config, rather than including the full malicious logic statically. A comment in the bundled server.js noted the live payload activates only 'after approval flip,' meaning after Mozilla approved the listing, while a separate server-review.js returned an inactive config during review. _Developers auditing extension permissions before install can track findings like this on daily.dev._ ### What happens if I enter my seed phrase into a fake Phantom, Jupiter, or Bitget wallet extension? The recovery phrase or private key is sent directly to the attacker's command-and-control server at a subdomain of bonto[.]io, and whoever holds a seed phrase or private key fully controls the wallet. In the Phantom variant, a bundled Node.js backend automatically sweeps funds to hardcoded payout addresses across nine blockchains including Ethereum, Solana, and Bitcoin, and logs the theft to a Telegram bot. _Anyone managing crypto wallet security can follow incident writeups like this through daily.dev._ ### How can I tell if a browser extension is secretly fetching and running remote code? Look for a fetch call to a configuration endpoint followed by eval or browser.scripting.executeScript, since that combination lets an extension run code that was never submitted for review. The Phantom-impersonator malware fetched a base64-encoded payload from phantom[.]bonto[.]io/config and executed it in the page's main world to access the wallet's own injected provider. _Developers reviewing extension permissions can keep an eye on techniques like this via daily.dev._ ## Similar posts on daily.dev - [Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites](https://daily.dev/posts/two-chrome-extensions-caught-secretly-stealing-credentials-from-over-170-sites-pps6thkfj) · The Hacker News · 67 upvotes · 1 comments - [Fake imToken Chrome Extension Steals Seed Phrases via Phishi...](https://daily.dev/posts/fake-imtoken-chrome-extension-steals-seed-phrases-via-phishi--lkqlowibp) · Socket · 0 upvotes · 0 comments --- Tags: [#crypto](https://daily.dev/tags/crypto), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing), [#firefox](https://daily.dev/tags/firefox) [View this post on daily.dev](https://daily.dev/posts/malicious-firefox-extensions-impersonate-phantom-jupiter-and-bitget-to-steal-wallet-secrets-cwxhzvfpd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets","url":"https://daily.dev/posts/malicious-firefox-extensions-impersonate-phantom-jupiter-and-bitget-to-steal-wallet-secrets-cwxhzvfpd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/malicious-firefox-extensions-impersonate-phantom-jupiter-and-bitget-to-steal-wallet-secrets-cwxhzvfpd"},"datePublished":"2026-10-27T20:07:05.966Z","dateModified":"2026-10-27T20:50:54.671Z","description":"Three Firefox extensions impersonating the Phantom, Jupiter, and Bitget crypto wallets were caught stealing recovery phrases and private keys. Using Unicode...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0b50d579191bfc259b39696560b6e8f5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0b50d579191bfc259b39696560b6e8f5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/malicious-firefox-extensions-impersonate-phantom-jupiter-and-bitget-to-steal-wallet-secrets-cwxhzvfpd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"crypto,malware,phishing,firefox","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/malicious-firefox-extensions-impersonate-phantom-jupiter-and-bitget-to-steal-wallet-secrets-cwxhzvfpd#faq","mainEntity":[{"@type":"Question","name":"How did the malicious Phantom Firefox extension bypass Mozilla's review process?","acceptedAnswer":{"@type":"Answer","text":"It shipped a small loader that fetched a second-stage stealer at runtime from phantom[.]bonto[.]io/config, rather than including the full malicious logic statically. A comment in the bundled server.js noted the live payload activates only 'after approval flip,' meaning after Mozilla approved the listing, while a separate server-review.js returned an inactive config during review. Developers auditing extension permissions before install can track findings like this on daily.dev."}},{"@type":"Question","name":"What happens if I enter my seed phrase into a fake Phantom, Jupiter, or Bitget wallet extension?","acceptedAnswer":{"@type":"Answer","text":"The recovery phrase or private key is sent directly to the attacker's command-and-control server at a subdomain of bonto[.]io, and whoever holds a seed phrase or private key fully controls the wallet. In the Phantom variant, a bundled Node.js backend automatically sweeps funds to hardcoded payout addresses across nine blockchains including Ethereum, Solana, and Bitcoin, and logs the theft to a Telegram bot. Anyone managing crypto wallet security can follow incident writeups like this through daily.dev."}},{"@type":"Question","name":"How can I tell if a browser extension is secretly fetching and running remote code?","acceptedAnswer":{"@type":"Answer","text":"Look for a fetch call to a configuration endpoint followed by eval or browser.scripting.executeScript, since that combination lets an extension run code that was never submitted for review. The Phantom-impersonator malware fetched a base64-encoded payload from phantom[.]bonto[.]io/config and executed it in the page's main world to access the wallet's own injected provider. Developers reviewing extension permissions can keep an eye on techniques like this via daily.dev."}}]} ```