Affected Systems
Mozilla Firefox users who installed any of 16 malicious extensions impersonating Rabby Wallet (4 extensions) and OKX Wallet (12 extensions). Extensions masqueraded as wallet portals, desktop utilities, and browser tools. All extensions removed from Mozilla Add-ons as of October 5, 2026.
Exploitation Status
Active campaign detected in the wild. Extensions were live and operational until removal on October 5, 2026. This represents a continuation of an earlier wave documented in August 2026. Threat actors are actively rotating package names, versions, and extension IDs while reusing the same credential-handling logic and network infrastructure (*.icy-star-f45c.workers[.]dev).
Business Impact
Users who entered cryptocurrency wallet recovery phrases or private keys into these fake wallet interfaces should assume full compromise of those wallets. Stolen credentials were exfiltrated to attacker-controlled Cloudflare Workers domains, enabling immediate theft of cryptocurrency assets. Organizations with Firefox deployments face potential financial loss if employees manage corporate or personal crypto wallets on managed devices. The campaign demonstrates sophisticated social engineering targeting cryptocurrency users specifically.
Urgency
🔴 Immediate
Recommended Actions
- Audit all Firefox installations for the 16 named extensions (view-focus-bright@webtools.co, quick-track-nest@tabtools.co, vibe-kit-tool@fasttools.co, edge-hub-snap@protools.net, core-hub-peak@neattools.example, sipoo-grozza@browserweb.com, mozart-seo@webtools.com, clean-file-bar@neattools.com, clean-net-timer@plugify.example, manager-square@webtools.com, manager-course@webtools.com, val-andrew@browserweb.com, manager-team@browserweb.com, valory-andrew@browserweb.com, franklin-uk@browserweb.com, franklin-uro@browserweb.com) and remove immediately if present
- Identify users who installed these extensions and instruct them to create new cryptocurrency wallets from clean systems and transfer all assets immediately
- Block network connections to *.icy-star-f45c.workers[.]dev domain at firewall and DNS level
- Deploy browser extension monitoring tools to detect suspicious data exfiltration patterns, particularly targeting wallet-related activity and connections to Cloudflare Workers domains
- Implement organizational policy requiring approval for all browser extension installations in managed environments, with specific scrutiny for cryptocurrency-related tools