Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets

What it is

Socket's Threat Research Team found three malicious Firefox add-ons impersonating Phantom (add-on ID 3092199, version 25.6.0), Jupiter (3092666, 1.19.2) and Bitget (3092059, 2.21.8). All three steal recovery phrases and private keys. Each was live during analysis and has been removed as of publication (October 2026). Each came from its own throwaway AMO developer account.

How it works

Every package ships a complete, always-on stealer in the signed code Mozilla reviewed. The Phantom fake also has a runtime stage:

• A loader appended to background/serviceWorker.js rebuilds the C2 host from a character-code array, with a comment calling it an "optional analytics module".
• It fetches https://phantom[.]bonto[.]io/config and reads a JSON object with an active flag and a base64 code field.
• It stores the decoded code in browser.storage.local under the key _px.
• It runs the code with eval through browser.scripting.executeScript, in the MAIN world first and then the isolated world.
• It re-injects on every tab load, on install and on startup.

The returned stage (4,029 bytes at time of writing) recognises 12, 15, 18 and 24 word seed phrases plus EVM and Solana private-key formats. It reads inputs, paste and focusout events, and numbered phrase grids in page text. It also wraps window.phantom.solana.connect to capture the public key, then POSTs JSON to the C2 host.

The Phantom package also contains the operator's drainer backend, server.js. It logs secrets, forwards them to a Telegram bot, and sweeps funds to hardcoded EVM, Solana and Bitcoin addresses. A second file, server-review.js, returns an inactive config during Mozilla's review. A code comment calls the switch to the live server the "approval flip".

flowchart TD
    A[Loader requests /config] --> B{Which server answers?}
    B -->|server-review.js, during review| C[active false: nothing runs]
    B -->|server.js, after approval| D[active true: stealer eval'd in every tab]

Jupiter and Bitget post secrets straight to jupiter[.]bonto[.]io and bitget[.]bonto[.]io. Jupiter's trojanized background.js (621 kB) sends the mnemonic on wallet import. Bitget's static/js/bg-init.js hooks the wallet's storage to take the seed as it is decrypted.

Preconditions / Affected

Impact needs a victim to install a fake and then enter, reveal or paste a secret. Reported daily users were only 1 to 3 per listing. The Phantom listing's reviews rose from 275 to 546 in about two days, and its average from 2.9 to 3.9, which buries one-star reports of lost funds.

What to do

• Block bonto[.]io and all subdomains. Alert on DNS lookups for brand-named subdomains under it. Known hosts are phantom, jupiter, bitget, coinbase and exodus. The IPs 104[.]21[.]34[.]69 and 172[.]67[.]155[.]198 are listed.
• Hunt for extensions with a signed bundle that injects into the main world. Flag any that fetch a config endpoint and then call eval or scripting.executeScript.
• Review extensions that request all-sites data together with tabs or scripting. Pin the extension IDs your team uses.
• Install wallets only from the vendor's own site link. If a seed phrase or key was entered into one of these, move funds to a new wallet created on a clean device.
• Match SHA-256 hashes from the page's IOC list. The Phantom XPI is 311c49974f28d33947b8b74d78b48f51855eacac182d519a4fe1daa6af7f30e9.

Caveats

• Coinbase and Exodus subdomains are provisioned and answer like the confirmed exfiltration hosts, but no matching AMO listings were found.
• Fund-loss claims in the user reviews are self-reported and unverified.
• The Phantom and Jupiter packages include an unused CLAUDE.md jailbreak prompt. Socket reads this as a sign of AI-assisted authoring and an attempt to subvert AI review.