Malicious Firefox wallet impersonators (Phantom/Jupiter/Bitget) — steal recovery phrases and private keys via bonto[.]io C2
Severity: high · Patch status: no-fix-needed · Since 2026-10-27
Socket's Threat Research Team identified malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget crypto wallets using Unicode homoglyph names and genuine branding. The signed packages contain always-on stealers that exfiltrate recovery phrases and private keys to brand-named subdomains of bonto[.]io (at least five provisioned, including coinbase and exodus). The Phantom impersonator additionally bundles a loader that fetches a second-stage stealer from phantom[.]bonto[.]io/config and executes it in the main world of every page, allowing payload swapping after review. All three listings were live on Firefox Add-ons during analysis and removed as of publication. Users who installed the extensions and entered wallet secrets are affected; no CVE applies.
What to do
- Remove any of these extensions from Firefox immediately and treat all crypto wallet secrets entered while installed as compromised
- Transfer affected wallet funds to new wallets with fresh recovery phrases and rotate private keys
- Audit installed Firefox extensions for homoglyph-named wallet impersonators and review extension permissions
- Block bonto[.]io and its subdomains at network egress
- Monitor for drainer-related transactions from affected wallets
Sources
All live incidents on Threat Watch
