Three Firefox extensions dressed as Phantom, Jupiter and Bitget wallets stole recovery phrases and private keys, according to Socket Threat Research’s October 27 analysis. The listings have since been removed from Firefox Add-ons. For a team whose people use crypto wallets in Firefox, removal from the store is a reason to inspect installed profiles and protect any wallet whose secret passed through one of these add-ons.
The Phantom impostor had a signed stealer in the extension package and another loader that fetched code after review. Socket found its remote configuration active during analysis. The Jupiter and Bitget impostors carried their stealers in their signed packages. Socket put it plainly: “Each signed package carries a complete, always-on stealer.” The package contents, rather than a malicious update alone, are the starting point for an installed-extension investigation.
Familiar icons hid hostile add-ons
The Phantom listing used Unicode lookalike characters in its name, copied the real wallet’s ghost icon and marketing language, and claimed to be an official Firefox update. The Jupiter listing claimed to be built by Jupiter Exchange. Bitget branding appeared on a listing whose manifest name was TabFlow Pro. The deceptive listing made store search an unreliable way to identify the genuine wallet.
Socket identified three Firefox Add-ons listing IDs: Phantom 3092199 at version 25.6.0, Jupiter 3092666 at version 1.19.2, and Bitget 3092059 at version 2.21.8. These identify the malicious listings, not the genuine wallets. Each listing came from a separate developer account. The Phantom listing’s reviews rose from 275 to 546 over roughly two days, while its average rating climbed from 2.9 to 3.9; users’ loss reports in those reviews are unverified. The reported daily users for each malicious listing were between one and three during Socket’s observation.
Phantom fetched a second stealer
In the Phantom package, a loader appended to background/serviceWorker.js reconstructed its host from character codes, fetched a JSON configuration from the path /config, decoded a base64 code field and injected the resulting code into open pages. It tried the page’s main execution world first, where it could reach an injected wallet provider, then fell back to the isolated content-script world. It repeated the injection on tab loads and at extension startup. The configuration contained an active flag; Socket saw it enabled with a 4,029-byte payload. The operator could change or turn off that second stage without submitting a new extension build.
That remote stage inspected input fields, text areas, paste events, focus changes and recovery-phrase grids; it recognized common BIP-39 phrase lengths and Ethereum and Solana key formats. It also observed the page’s Solana provider. Captured secrets went to a brand-named host under bonto[.]io. Separately, the signed Phantom package’s analytics.js stole secrets from its own popup and onboarding pages. Socket also found a bundled server.js drainer backend and a server-review.js that returned an inactive configuration during review. An operator comment referred to an “after approval flip”; that phrase describes the intended server switch, while Socket observed the live configuration at analysis time.
The other two extensions needed no downloaded stage. Jupiter’s bundled background.js sent a phrase or key on wallet import; its hook.js read page inputs and clipboard content. Jupiter also requested host access to the legitimate Trezor Connect service at connect.trezor.io, widening the pages it could read. Bitget’s static/js/hook.js watched page content and extension messages, while static/js/bg-init.js accessed the wallet’s storage when the seed was decrypted and directed users into an import screen. A clean hunt for the Phantom configuration request alone would miss these in-package stealers.
Match extensions before moving funds
For Firefox profiles used with crypto wallets, compare installed add-on IDs and Gecko IDs with Socket’s reported values. Phantom: listing 3092199, Gecko ID a8f3k2m9x1fefb7q4n6p0r5t@j2w8c4fefy6v1d3z9; Jupiter: 3092666, {48392751-9302-4817-5621-703829164830}; Bitget: 3092059, {c31e7a95-2f64-4b18-a0d3-6e92f5c7481b}. Preserve the add-on, version and profile evidence for a match, then remove the malicious extension. For new installations, follow the wallet vendor’s own link to its extension and pin the approved extension ID in managed-browser inventory. Unicode lookalikes defeat a name-based allowlist; pin the approved extension ID instead.
Search retained DNS and web telemetry for the apex bonto[.]io and its brand hosts: phantom[.]bonto[.]io, jupiter[.]bonto[.]io, bitget[.]bonto[.]io, coinbase[.]bonto[.]io and exodus[.]bonto[.]io. Socket found the last two hosts provisioned; it identified confirmed malicious add-on listings for Phantom, Jupiter and Bitget. Block the apex and its subdomains where your policy permits, and review matches alongside the installed-extension inventory. The reported IPs 104.21.34.69 and 172.67.155.198 are Cloudflare addresses fronting the infrastructure, so use the named hosts rather than broad IP blocks that could affect other tenants. In a preserved extension bundle, background/serviceWorker.js, analytics.js, static/js/hook.js and static/js/bg-init.js are useful file-level leads; the source’s XPI SHA-256 values are Phantom 311c49974f28d33947b8b74d78b48f51855eacac182d519a4fe1daa6af7f30e9, Jupiter fd7b138f4fba003db332a4eee833e84491bf7ffec5a3d91f7451d7b95aabcf6a, and Bitget e688bff5df32f209b4ebb882985e3ad19ddee68666405c39ff523307068a8611. Socket’s October 21 Phantom second-stage sample hashes to 999bccd41188a238a50d05b5aca8e35af45d107f32d7443389313816f0cb226a; the operator-controlled stage can change.
Remove impostors and rotate wallet secrets
A recovery phrase is a bearer secret. For a matched Phantom profile, preserve its installed version and background/serviceWorker.js before removing the add-on. If one was entered, revealed or pasted while a matched add-on was installed, create a new wallet on a clean device and move the assets to its new seed; deleting an extension cannot make the old seed private again. Investigate any transactions or connected-wallet activity that followed the exposure. If you find a listed add-on but have no browser or network history covering its use, handle that wallet as potentially exposed rather than treating an empty DNS search as clearance.
Check the affected Firefox profiles again after removal. Compare installed extension IDs and versions: the Phantom 3092199 / 25.6.0, Jupiter 3092666 / 1.19.2 and Bitget 3092059 / 2.21.8 impostors and their Gecko IDs should be absent. Inspect retained DNS logs for bonto[.]io: subsequent lookups to its named hosts should cease, and assets from a potentially exposed seed should reside in a fresh wallet. Store takedown protects future shoppers; profile inventory and a new secret protect the person who already installed the fake.