This malicious Firefox extension will drain your crypto wallet

This malicious Firefox extension will drain your crypto wallet
A malicious Firefox add-on called "Safepal Wallet" managed to stay listed on the official Mozilla add-ons website for seven months because it scammed users by emptying their cryptocurrency wallets. SafePal is a legitimate hardware cryptocurrency wallet designed to hold over 10,000 asset types, including Bitcoin, Ethereum, and Litecoin. However, while the wallet has official smartphone apps available for both the Apple AppStore and the Google Play Store, the website does not list any browser extensions.

TheComparison needs you! We take a look at how our readers are using VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey will take no more than 60 seconds of your time and we would greatly appreciate it if you would share your experiences with us.
Click here to launch the survey in a new window
“After I installed this extension and logged in with my credentials, it didn't work,” Firefox user Cali reported, adding that when they checked about 8 hours later, their crypto worth roughly € 4,000 had been transferred to another wallet.

Due diligence

Five days after Cali's public report on the incident this month, a Mozilla spokesperson responded by saying they were investigating the incident, before removing the fake plugin listing. Reporting on development, BleepingComputer explains that in order to publish a plugin on Mozilla's plugin website, developers must go through a submission process which states that submitted plugins are "subject to review by Mozilla at any time." However, the scope of that review is not specified, and Mozilla has also not explained how the fake plugin managed to get listed. Furthermore, although the malicious browser plugin has been removed, BleepingComputer reports that the phishing website created by the threat actors is still operational. The website asks users for their secret twelve-word saved phrase to match the SafePal wallet, which is then silently sent to the threat actor behind the fake extension. Via BleepingComputer

You might also be interested ...