Firefox is being flooded with crypto wallet scam extensions

Crytocurrency hasn’t just ruined the hunt for an affordable graphics card, or the conversation at that little bar you used to like. Now it’s come for everyone’s favorite alt browser, too. Dozens of fake cryptocurrency wallet extensions—indistinguishable from their nominally legitimate counterparts—are flooding Firefox’s add-on repository. It’s a problem.

Koi Security researchers report that a coordinated campaign has been going on since April of this year, posting fake versions of popular crypto wallets like Coinbase, Ethereum, and MetaMask, making copies of the open-source wallet programs and inserting malicious code. The fake versions of the wallets will steal user data—primarily the access to real cryptocurrency—allowing the allegedly Russian-speaking hackers to drain the legitimate crypto accounts.

Copied names and logos, fake reviews, and the usual spammy nonsense are being used to impersonate the real versions of the cryptocurrency wallets. Though Mozilla has automated systems in place to prevent malicious extensions from getting into the repository, these systems seem to be overwhelmed, with at least 40 fakes making it through (most subsequently removed) as of this week. BleepingComputer was given an official comment on the situation, but it seems fairly boilerplate.

Even well after the crypto and NFT boom has died down, there are still hundreds of billions of dollars’ worth of value tied up in Bitcoin and its many alternatives. If you need access to these systems, double- and triple-check your sources for software and tools, going directly to the necessary URLs if possible. Once “anonymous” cryptocurrency gets stolen, especially across international borders, it’s all but impossible to recover.