Researchers found 16 malicious Firefox browser extensions pretending to be Rabby or OKX crypto wallets. When a user imports a wallet, the fake add-ons capture the recovery phrase/private key and send it to attacker-controlled Cloudflare Workers, enabling wallet takeover and theft.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You search Firefox add-ons for Rabby or OKX Wallet, click install, and think, "Cool, legit wallet set up." But 16 fake Firefox extensions copied Rabby and OKX. When you hit "Import wallet" and type your recovery phrase, they quietly grab it and send it off to icy-star-f45c.workers.dev. Aha moment: real wallets don’t need your seed phrase in some random Firefox add-on with a weird name and zero history. If you typed a real phrase into something like that, assume that wallet’s gone. Your move: if you ever entered a recovery phrase or private key into a Firefox wallet add-on you’re not 100% sure about, stop using that wallet, create a new one on a clean device, and move your funds now.
Researchers found 40 malicious Firefox extensions pretending to be popular Web3 wallet products (like OKX, Rabby Wallet, and TronLink) to steal crypto wallet secrets. The extensions trick users into installing them, then capture recovery phrases/private keys and send them to attacker-controlled…
Researchers found a real phishing campaign abusing npm packages and unpkg mirrors to host a convincing fake Cloudflare CAPTCHA page on a trusted domain. Victims who click the mirrored link are redirected to attacker-controlled infrastructure that could deliver ClickFix-style prompts or credential…
This bulletin describes multiple real-world scams where attackers manipulate trust to steal money or sensitive data. Notably, attackers impersonated executives to pressure legal teams into moving M&A discussions to WhatsApp/personal email to trigger international wire transfers, and Trezor users…
Multiple China-aligned espionage groups used phishing emails to deliver a “BlueMoon” exploit chain that abused three zero-day flaws in Chrome/Chromium and Windows. In observed campaigns, victims who clicked the phishing link ended up with a malicious browser extension disguised as Google Gemini,…
Cisco Talos described real ClickFix campaigns where attackers trick people into pasting code either into the Chrome address bar (or a browser extension) or into the Windows Run dialog. The first campaign targeted crypto swap sites and used a fake “leaked vulnerability report” to get victims to run…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
