16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

If you typed a wallet recovery phrase or private key into one of these Firefox extensions, treat that wallet as compromised. Removing the extension is necessary, but it does not undo the exposure, and changing the extension’s password does not help either. The safe sequence is to remove the extension, create a new wallet on a clean device, move your assets, revoke token approvals, and treat every account derived from the exposed phrase as compromised.

Socket Threat Research published its findings on October 7, 2026. The report identifies 16 malicious Firefox extensions: four cloned from the Rabby wallet and twelve OKX-style wallet-portal clones. Its author, Joseph Edwards, is listed as a Socket researcher.

#	Preview	Product	Price
1		Yubico - Security Key C NFC - Basic Compatibility - Multi-Factor authentication (MFA) Security Key...	$29.00	Buy on Amazon
2		Yubico - Security Key NFC - Basic Compatibility - Multi-Factor Authentication (MFA) Key, Connect via...	$29.00	Buy on Amazon
3		FIDO2 U2F Security Key Passkey Two-Factor Authentication (2FA) USB Key PIN+Touch (Non-Biometric)...	$20.00	Buy on Amazon
4		Thetis Nano-A FIDO2 Security Key Hardware Passkey Device with USB Type A, TOTP/HOTP, FIDO2.0 Two...	$22.49	Buy on Amazon
5		FIDO2 U2F Security Key Passkey Two-Factor Authentication (2FA) USB Key PIN+Touch (Non-Biometric)...	$18.00	Buy on Amazon

What the campaign did

• The extensions used wallet portals, desktop utilities, and browser-tool pages as lures, so a user could reasonably believe they were installing a genuine wallet or tool.
• During wallet import flows, the code captured 12- or 24-word recovery phrases. The four Rabby clones also captured 64-character hexadecimal private keys.
• Captured secrets were sent to attacker-controlled endpoints on Cloudflare Workers. Socket reports that the Rabby clones placed secrets in GET request query parameters. The active OKX-style variants sent them in HTTPS POST requests with JSON bodies, and one variant also used beacon, fetch, and image-request fallbacks.
• Socket assesses with high confidence that this activity continues a wave it documented in August 2026. The report does not name a specific actor, and this article does not attribute the campaign to one.

The affected extensions

The table below lists the extension IDs and versions as Socket published them. Socket’s report gives a status for only one entry; where it does not, the table says so rather than guessing.

Mozilla had unpublished these extensions by October 5, 2026, according to Socket. That is a status as of that date. It does not cover lookalike extensions published under different IDs, and it does not make an extension you installed earlier safe to have run.

#1 Best Overall

Yubico - Security Key C NFC - Basic Compatibility - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified

• POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
• WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
• FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
• TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
• BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.

$29.00

Buy on Amazon

How to judge your exposure

Do not use the broken status of one package as a reason to relax. Work through these questions first:

• Did you install any extension with one of the IDs above, or one whose name resembles Rabby, OKX, or a generic wallet portal?
• Did you reach the import screen and paste or type a recovery phrase or private key while it was installed?
• Was the extension installed on any other Firefox profile or device signed into the same Firefox account?

If you answered yes to the first two questions, assume exposure. Only a broken package, such as sipoo-grozza@browserweb.com, would be less likely to have sent data, and even then the collection code was present, so follow the same steps.

Rank #2

Yubico - Security Key NFC - Basic Compatibility - Multi-Factor Authentication (MFA) Key, Connect via USB-A or NFC, FIDO Certified

• POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
• WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
• FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
• TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
• BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.

$29.00

Buy on Amazon

If you entered a recovery phrase or private key

1. Stop using the wallet. Do not send new transactions or sign new approvals from the exposed wallet until the steps below are complete.
2. Remove the extension. Open about:addons in Firefox, select Extensions, find the listed ID, and choose Remove. Restart Firefox afterwards.
3. Check every device on the same Firefox account. If Firefox Sync carried the extension to other computers or phones, remove it there too by opening about:addons on each device.
4. Create a new wallet on a clean device. Use a computer or browser profile that never had these extensions installed. Install the wallet from its official download source, generate a new recovery phrase, and write it down offline. Never reuse the old phrase for anything.
5. Move your assets. Transfer funds and tokens from the exposed wallet to the new one, starting with the highest-value holdings. Whoever collected the phrase can act at any time, so do not wait for a convenient moment.
6. Revoke token approvals. From the exposed address, review and revoke token spending approvals on each network where it held assets, starting with unlimited approvals. Revocations are transactions and cost network fees, so do this after the assets have moved.
7. Treat all derived accounts as compromised. Every address generated from the same phrase is exposed, including addresses on networks you did not check and addresses you rarely use.

Why changing a password does not help

The extension’s password protects only the local copy of the phrase stored by that extension. The attacker received the phrase itself during import, so a new extension password does not remove the attacker’s copy. Only moving to a new phrase reduces the risk.

If you entered a private key

The Rabby clones captured raw private keys as well as phrases. A private key controls the single account it belongs to, so the account that key controls is compromised. Follow the same steps for that account, and check whether the same key was used anywhere else.

Quick Recap

Bestseller No. 1

Yubico - Security Key C NFC - Basic Compatibility - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified

$29.00

Bestseller No. 2

Yubico - Security Key NFC - Basic Compatibility - Multi-Factor Authentication (MFA) Key, Connect via USB-A or NFC, FIDO Certified

$29.00

Bestseller No. 3

FIDO2 U2F Security Key Passkey Two-Factor Authentication (2FA) USB Key PIN+Touch (Non-Biometric) USB-C Type TrustKey T120

For the driver download and user guide, please visit TrustKey Solutions Home support page.

$20.00

SaleBestseller No. 4

Thetis Nano-A FIDO2 Security Key Hardware Passkey Device with USB Type A, TOTP/HOTP, FIDO2.0 Two Factor Authentication 2FA MFA, Works with Windows/mac/iOS/Android/Linux/Gmail/Facebook/GitHub/Coinbase

$22.49

Bestseller No. 5

FIDO2 U2F Security Key Passkey Two-Factor Authentication (2FA) USB Key PIN+Touch (Non-Biometric) USB-A Type TrustKey T110

For the driver download and user guide, please visit TrustKey Solutions Home support page.

$18.00

Best Value

FIDO2 U2F Security Key Passkey Two-Factor Authentication (2FA) USB Key PIN+Touch (Non-Biometric) USB-A Type TrustKey T110

• Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
• Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
• Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
• Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
• For the driver download and user guide, please visit TrustKey Solutions Home support page.

$18.00

Buy on Amazon

Rank #4

Sale

Thetis Nano-A FIDO2 Security Key Hardware Passkey Device with USB Type A, TOTP/HOTP, FIDO2.0 Two Factor Authentication 2FA MFA, Works with Windows/mac/iOS/Android/Linux/Gmail/Facebook/GitHub/Coinbase

• Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
• USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
• FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
• Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
• Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.

$22.49

Buy on Amazon

Rank #3

FIDO2 U2F Security Key Passkey Two-Factor Authentication (2FA) USB Key PIN+Touch (Non-Biometric) USB-C Type TrustKey T120

• Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
• Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
• Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
• Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
• For the driver download and user guide, please visit TrustKey Solutions Home support page.

$20.00

Buy on Amazon

What the report does not establish

• Socket documents credential collection and attempted exfiltration. The report does not establish how many people installed these extensions or how many suffered losses.
• Not every entry of a phrase is established to have led to theft. Treat exposure as the working assumption, not as proof of a specific loss.
• Removing the extension does not reverse exposure. Only replacing the phrase and moving assets address that.
• Socket cites adoption figures from 2026 for context: 900,000 Rabby users on the Chrome Web Store, 500,000 Rabby downloads on Google Play, and over 1,000,000 OKX Wallet users on the Chrome Web Store. These are the figures as Socket states them, not independently verified counts, and they are not measures of campaign reach or victims.

Guidance for defenders

• Block the listed extension IDs and the XPI file hashes published in Socket’s report.
• Search extension inventories for the shared file hashes and these campaign strings: the shared marker EQOx7EIPZSNi, and the static detection strings Raabby WaIIet, SEED_PHRASE_IMPORT, and WALLET_SYNC.
• Review proxy and DNS records for the Workers namespace icy-star-f45c[.]workers[.]dev. Socket reports that 15 of the extensions contacted this namespace; the broken variant used a different Workers hostname while keeping campaign markers. Redact any query string or request body that may contain a secret before sharing logs.
• Do not visit the listed endpoints or interact with them from a user device.
• Preserve the original extension packages and browser profiles for investigation.
• Never run the extensions on an analyst host.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.