Dozens of Fake Firefox Wallet Extensions Linked to Crypto-Stealing Malware
Forty are confirmed malicious, impersonating OKX, Rabby and TronLink to harvest recovery phrases from anyone who types one in.
Sunday, 8 November 2026
Independent coverage of global markets, trade and finance
Crypto
National Trade News policy desk (2026-08-25): Forty are confirmed malicious, impersonating OKX, Rabby and TronLink to harvest recovery phrases from anyone who types one in. Primary source: original at Decrypt (decrypt.co).
Dozens of Fake Firefox Wallet Extensions Linked to Crypto-Stealing Malware
Forty are confirmed malicious, impersonating OKX, Rabby and TronLink to harvest recovery phrases from anyone who types one in.