1-minute read
What a defender needs to know
Socket Threat Research found three malicious Firefox add-ons posing as Phantom, Jupiter and Bitget wallets. Their listings have been removed. The signed packages already contained stealers; the Phantom impostor also fetched an operator-controlled stage after review, injected it into pages and read wallet secrets. Socket observed that remote stage active. A clean search for its configuration request would miss the bundled Jupiter and Bitget stealers.
Compare Firefox extension inventory with listing IDs 3092199 (Phantom), 3092666 (Jupiter) and 3092059 (Bitget), and preserve any matching profile, add-on and version before removal. Search DNS and web telemetry for bonto[.]io and the named hosts phantom[.]bonto[.]io, jupiter[.]bonto[.]io and bitget[.]bonto[.]io; block the apex and its subdomains where policy permits. Approve the specific wallet extension ID through a link on the vendor’s site; copied icons and lookalike names defeat name-based matching.
If a recovery phrase or private key was entered, revealed or pasted during exposure, move assets to a new wallet created on a clean device. An absent network match offers little reassurance if historical browser or DNS data is unavailable. After containment, verify that listed IDs have disappeared from affected profiles, traffic to the named hosts has stopped and exposed assets are on a fresh seed. Socket reported one to three daily users per listing during its observation; loss claims in store reviews remain unverified.