Security company: Dozens of fake encrypted wallet extensions flood Firefox plugin store

Odaily Planet Daily News: Security company Koi has revealed that over 40 counterfeit cryptocurrency wallet extensions have appeared in the official Firefox browser plugin store, including mainstream wallets such as MetaMask and Coinbase Wallet. These malicious plugins steal input content exceeding 30 characters (mainly targeting mnemonic words) by implanting event monitoring code, and transmit the data back to the attacker's server. The investigation shows that the phishing activity has been ongoing since at least April 2025, and the mastermind behind it is suspected to be a Russian speaking hacker organization. （BleepingComputer ）