{
 "tag": "firefox",
 "name": "Firefox",
 "group": "Platforms & channels",
 "incidents": [
  {
   "slug": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "title": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "json": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "malicious-extension",
   "product": "Firefox users who installed fake Rabby Wallet or OKX Wallet add-ons",
   "tags": [
    "multi-evm",
    "malicious-extension",
    "firefox",
    "browser-extension",
    "fake-wallet",
    "rabby",
    "okx-wallet",
    "seed-phrase-theft",
    "socket"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-05",
   "closedAt": null,
   "updatedAt": "2026-10-07T12:00:00Z",
   "summary": "Socket found 16 Firefox extensions posing as Rabby Wallet (branded 'Raabby WaIIet') and OKX Wallet ('Portal WALLET'). They captured 12- or 24-word recovery phrases and private keys during the wallet import step and sent them to attacker-run Cloudflare Workers. Mozilla removed them by 5 October 2026, but Socket links them to a crypto-theft extension campaign it first saw in August 2026, so new copies may appear. No loss figure has been published; anyone who imported a seed into one of them should treat that wallet as stolen."
  }
 ],
 "changes": [
  {
   "incident": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "incidentTitle": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "severity": "medium",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-07",
   "title": "Socket published its analysis, linking the add-ons through a shared campaign marker to crypto-theft extensions it found in August 2026.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026"
  },
  {
   "incident": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "incidentTitle": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "severity": "medium",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-05",
   "title": "Mozilla unpublished the 16 malicious extensions from the Firefox add-ons store.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026"
  }
 ]
}