77 Firefox Extensions Linked to Crypto Wallet and Credential Theft

Socket identified 40 malicious extensions that steal wallet secrets or credentials, plus 37 deceptive sports-score shells linked through shared code, infrastructure, publishing artifacts, and version histories. The Socket Threat Research team is tracking 77 Firefox extension identities linked through code reuse, cloned extensions, deceptive marketplace descriptions, author-selected add-on ID patterns and domain-like suffixes, cryptocurrency-wallet impersonation, and version histories showing extension repurposing. Extension-level analysis confirms 40 as malicious.