Blockchain

Socket Finds 16 Fake Rabby and OKX Wallet Extensions on Firefox

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 23/10/2026, 10:57:24 UTC.

Briefings

Security researchers identified 16 fake Rabby and OKX wallet extensions on Firefox that were published by Mozilla on October 5, 2026. These malicious add-ons were not removed by Mozilla, leaving users' wallets vulnerable even if their recovery phrases were exposed. The findings indicate that simply deleting the extensions does not secure accounts against phishing attacks targeting these specific wallet services.

Key points

• 16 fake wallet extensions were published by Mozilla on October 5, 2026, and remain active despite security warnings.
• Removing these extensions does not protect users whose recovery phrases were already compromised.

Context

Mozilla had unpublished these malicious add-ons on October 5, 2026, prompting security concerns. However, the security firm explicitly states that deleting the extensions does not secure wallets whose recovery phrases were already exposed, indicating a critical gap in user protection mechanisms.

Limitations

The evidence is limited to the specific date of October 5, 2026, and the security firm's statement that deletion does not secure exposed wallets. The full scope of the attack, the number of affected users, and the specific phishing campaigns are not detailed in the provided source.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 23/10/2026, 11:04:20 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeiee3zsoyln2i2tf3wsvh2ss7cotghzmsjb4llznxbbrbatjfkfwzq