# Malicious browser extensions · Drain Watch

5 incidents, 2 live. JSON: https://drains.watch/t/malicious-extension.json · RSS: https://drains.watch/t/malicious-extension/feed.xml

- [16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys](https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026) (live, Medium, Partly contained, since Oct 5, 2026)
- [19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons](https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026) (live, High, Partly contained, since Aug 30, 2026)
- [Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets](https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025) (closed, Critical, Contained, since Dec 24, 2025)
- [Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key](https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025) (closed, Medium, Partly contained, since Aug 13, 2025)
- [Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer](https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025) (closed, High, Partly contained, since Jul 10, 2025)