Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets

A sophisticated cyber threat campaign has utilized deceptive Firefox extensions to target users of prominent cryptocurrency wallets like Phantom, Jupiter, and Bitget. These malicious applications mimic genuine wallets using Unicode homoglyphs to trick users into installation. The theft mechanisms vary: the Phantom variant employs a dynamic loader that fetches a secondary stealer at runtime, allowing for payload manipulation post-review. In contrast, the Jupiter and Bitget variants bundle their stealers directly within the signed package.
The primary vector of attack involves harvesting sensitive assets such as recovery phrases (BIP-39) and private keys by monitoring input fields, tracking clipboard activities, and intercepting wallet provider calls in web pages. The stolen secrets are exfiltrated to brand-named subdomains under a single command-and-control apex, bonto[.]io, which is fronted by Cloudflare for obfuscation. Furthermore, the Phantom variant integrates a hidden Node.js backend that can automate fund sweeping across multiple major blockchains.
Users who have engaged with these extensions face high risk, as recovery phrases and private keys grant full control over assets. Recommended immediate actions include moving funds to new wallets on clean devices if any secret was potentially compromised.

* Malicious Firefox extensions impersonate Phantom, Jupiter, and Bitget crypto wallets.
* The extensions utilize Unicode homoglyphs in their public display names for mimicry.
* Stolen wallet secrets—recovery phrases and private keys—are routed to subdomains under the apex bonto[.]io.
* The Phantom impersonator uses a loader that fetches a second-stage stealer from phantom[.]bonto[.]io/config at runtime.
* The Jupiter and Bitget impostors bundle their stealers directly within the signed extension package.
* The extensions request broad browser permissions while falsely stating no data collection is required in their listings.
* The Phantom variant includes a bundled Node.js drainer backend capable of sweeping funds across Ethereum, Solana, Bitcoin, and others.
* Infrastructure for exfiltration included brand-named subdomains such as coinbase[.]bonto[.]io and exodus[.]bonto[.]io.
* Three distinct AMO developer accounts were used to publish the confirmed listings.
* The Phantom loader reconstructs its Command-and-Control host from a character-code array.

The core narrative presents an extremely targeted, high-fidelity social engineering attack disguised as functional software. By cloning the visual identity and leveraging established trust in heavily used crypto ecosystems—Phantom, Jupiter, Bitget—the actors successfully minimize cognitive friction for the victim. This technique capitalizes on 'brand resonance,' substituting genuine digital authority with highly convincing fraudulent simulacra. The technical sophistication warrants scrutiny: the dynamic payload delivery via the Phantom loader allows the attacker to perform a calculated "approval flip," holding a latent exploit until it passes initial review, suggesting an advanced understanding of platform moderation lifecycles.
This campaign echoes historical patterns in credential harvesting where deceptive UX is used as the primary attack surface, shifting focus from zero-day software vulnerabilities toward human behavioral trust dynamics. The use of homoglyphs alone points to a dedication to low-level evasion, designed to bypass superficial visual checks during rapid review processes. Furthermore, the construction utilizing an apex domain (bonto[.]io) with multiple brand subdomains suggests modularity and rapid threat diversification; if one subdomain is taken down, operational reach persists via others.
The fundamental assumption underpinning this attack is that user verification in high-stakes financial environments often relies on surface-level branding rather than verifiable provenance (i.e., checking the true ID or installer source). The ultimate beneficiaries are the actors controlling the Telegram infrastructure and the hardcoded crypto addresses, gaining direct control over significant capital pools upon victim interaction.
What structural assumptions underpin market reliance on rapid software adoption without deep verification of backend execution? How does the current ecosystem framework adequately distinguish between benign functionality (like a loader script) and malicious payload delivery disguised as an update mechanism? If trust is systematically eroded by increasingly perfect digital impersonation, what new systemic anchors must be developed for secure financial interaction online?
Patterns detected: ARC-0149 Social Engineering Via Digital Masquerade