{
 "slug": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
 "title": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
 "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026",
 "json": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026.json",
 "status": "live",
 "severity": "medium",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "multi-evm"
 ],
 "method": "malicious-extension",
 "product": "Firefox users who installed fake Rabby Wallet or OKX Wallet add-ons",
 "tags": [
  "multi-evm",
  "malicious-extension",
  "firefox",
  "browser-extension",
  "fake-wallet",
  "rabby",
  "okx-wallet",
  "seed-phrase-theft",
  "socket"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-10-05",
 "closedAt": null,
 "updatedAt": "2026-10-07T12:00:00Z",
 "summary": "Socket found 16 Firefox extensions posing as Rabby Wallet (branded 'Raabby WaIIet') and OKX Wallet ('Portal WALLET'). They captured 12- or 24-word recovery phrases and private keys during the wallet import step and sent them to attacker-run Cloudflare Workers. Mozilla removed them by 5 October 2026, but Socket links them to a crypto-theft extension campaign it first saw in August 2026, so new copies may appear. No loss figure has been published; anyone who imported a seed into one of them should treat that wallet as stolen.",
 "timeline": [
  {
   "date": "2026-10-05",
   "title": "Mozilla unpublished the 16 malicious extensions from the Firefox add-ons store.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers"
  },
  {
   "date": "2026-10-07",
   "title": "Socket published its analysis, linking the add-ons through a shared campaign marker to crypto-theft extensions it found in August 2026.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials",
   "url": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "publisher": "Socket",
   "date": "2026-10-07"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nOnly if you installed a Rabby or OKX wallet extension on Firefox from a listing that was not the official one (names like 'Raabby WaIIet' or 'Portal WALLET') and typed a recovery phrase or private key into it.\n\n## What to do now\n- Remove the extension.\n- On a clean device, install the real wallet from the link on its official website, create a new wallet and move all funds there. Changing the extension password does not help, because the seed itself was stolen.\n- After moving funds, revoke token approvals on the old address.\n\n## How to avoid this\n- Install wallet extensions only from the link on the wallet's official website, and check the publisher name and user count.\n- Watch for spelling tricks such as a capital I in place of a lowercase l, or doubled letters.\n- No real wallet needs you to re-import your seed to fix, verify or update anything.",
 "notes": null,
 "agentBrief": "# 16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys\n\n- Severity: Medium · Status: Partly contained (live)\n- Chains: Multiple EVM chains · Method: Malicious browser extensions\n- Started: Oct 5, 2026 · Last update: Oct 7, 2026\n- Who/what: Firefox users who installed fake Rabby Wallet or OKX Wallet add-ons\n\nSocket found 16 Firefox extensions posing as Rabby Wallet (branded 'Raabby WaIIet') and OKX Wallet ('Portal WALLET'). They captured 12- or 24-word recovery phrases and private keys during the wallet import step and sent them to attacker-run Cloudflare Workers. Mozilla removed them by 5 October 2026, but Socket links them to a crypto-theft extension campaign it first saw in August 2026, so new copies may appear. No loss figure has been published; anyone who imported a seed into one of them should treat that wallet as stolen.\n\n## Am I affected?\nOnly if you installed a Rabby or OKX wallet extension on Firefox from a listing that was not the official one (names like 'Raabby WaIIet' or 'Portal WALLET') and typed a recovery phrase or private key into it.\n\n## What to do now\n- Remove the extension.\n- On a clean device, install the real wallet from the link on its official website, create a new wallet and move all funds there. Changing the extension password does not help, because the seed itself was stolen.\n- After moving funds, revoke token approvals on the old address.\n\n## How to avoid this\n- Install wallet extensions only from the link on the wallet's official website, and check the publisher name and user count.\n- Watch for spelling tricks such as a capital I in place of a lowercase l, or doubled letters.\n- No real wallet needs you to re-import your seed to fix, verify or update anything.\n\n## Sources\n- 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials (Socket, 2026-10-07): https://socket.dev/blog/firefox-crypto-wallet-stealers\n\nFull record: https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026 · JSON: https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}