Dozens of fake wallet add-ons flood Firefox store to drain crypto
#1
Exclamation 
Quote:More than 40 fake extensions in Firefox’s official add-ons store are impersonating popular cryptocurrency wallets from trusted providers to steal wallet credentials and sensitive data.

Some of the extensions pretend to be wallets from Coinbase, MetaMask, Trust Wallet, Phantom, Exodus, OKX, Keplr, and MyMonero, and include malicious code that sends stolen information to attacker-controlled servers.
 
[Image: ext2.jpg]Fake wallet extensions on the Firefox add-ons store
Source: BleepingComputer

Researchers at Koi security found the risky extensions along with evidence indicating that behind the campaign is a Russian-speaking threat group.

In a report shared with BleepingComputer, the researchers say that many of these browser add-ons are clones of open-source versions of legitimate wallets with added malicious logic.

Koi security presents examples of ‘input’ and ‘click’ event listeners in the code, which monitor for sensitive data inputs from the victim.
 
[Image: 1.jpg]Malicious code snippets in the extensions
Source: Koi Security

The code checks for input strings that are longer than 30 characters to filter for realistic wallet keys/seed phrases, and exfiltrates the data to the attackers.

Error dialogs are hidden from the user by setting the opacity to zero for any elements that might alert the user of the activity.

Seed phrases (recovery/mnemonic phrase) are master keys typically comprising multiple words, allowing users to recover or port wallets to new devices.
Obtaining someone’s seed phrase makes it possible to steal all the cryptocurrency assets in the wallet. The theft appears as a legitimate transaction and is irreversible.

The campaign has been active since at least April and new extensions appear to be added to the Firefox store constantly. The researchers say that the newest malicious entries are as recent as last week.

Continue Reading...
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)
[-]
Welcome
You have to register before you can post on our site.

Username/Email:


Password:





[-]
Recent Posts
GFYI [Official] Ashampoo Snap v17 Fathe...
GIVEAWAY HAS ENDED. ...jasonX — 03:42
GFYI [Official] Revo Registry Cleaner P...
GIVEAWAY HAS ENDED. ...jasonX — 03:42
K-Lite Codec Pack 19.0.5 / 19.0.7 Update
Changes in 19.0.7 ...harlan4096 — 05:52
AnyDesk 9.5.8 for Windows
AnyDesk 9.5.8 for ...harlan4096 — 05:50
Notepad++ v8.8.3
Notepad++ v8.8.3 s...harlan4096 — 05:49

[-]
Birthdays
Today's Birthdays
avatar (49)WillieVot
Upcoming Birthdays
avatar (45)RidgeDimb
avatar (36)ipumaqar
avatar (50)tanliorsPeri
avatar (42)lapedDow
avatar (48)rituabew
avatar (36)omyjul
avatar (40)papedDow
avatar (49)ArnoldFum
avatar (37)yfaza
avatar (48)Kevensi
avatar (38)boineDon
avatar (39)Grompelbawn
avatar (40)vkseogaF
avatar (36)usogy
avatar (39)ywixazok
avatar (37)ixoqe
avatar (35)pa.OpenTran

[-]
Online Staff
jasonX's profile jasonX
Administrator

>