{
 "tag": "socket",
 "name": "Socket",
 "group": "Other",
 "incidents": [
  {
   "slug": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "title": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "json": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "malicious-extension",
   "product": "Firefox users who installed fake Rabby Wallet or OKX Wallet add-ons",
   "tags": [
    "multi-evm",
    "malicious-extension",
    "firefox",
    "browser-extension",
    "fake-wallet",
    "rabby",
    "okx-wallet",
    "seed-phrase-theft",
    "socket"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-05",
   "closedAt": null,
   "updatedAt": "2026-10-07T12:00:00Z",
   "summary": "Socket found 16 Firefox extensions posing as Rabby Wallet (branded 'Raabby WaIIet') and OKX Wallet ('Portal WALLET'). They captured 12- or 24-word recovery phrases and private keys during the wallet import step and sent them to attacker-run Cloudflare Workers. Mozilla removed them by 5 October 2026, but Socket links them to a crypto-theft extension campaign it first saw in August 2026, so new copies may appear. No loss figure has been published; anyone who imported a seed into one of them should treat that wallet as stolen."
  },
  {
   "slug": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "title": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "json": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm",
    "solana",
    "tron"
   ],
   "method": "malicious-extension",
   "product": "Users of 19 Chrome/Edge extensions incl. 'Enable Right Click & Copy', 'Multi-Chain Explorer' and 'LedgerLook: Wallet Checker'",
   "tags": [
    "multi-evm",
    "solana",
    "tron",
    "malicious-extension",
    "chrome",
    "edge",
    "browser-extension",
    "extension-takeover",
    "seed-phishing",
    "clickfix",
    "ledger",
    "trezor",
    "metamask",
    "socket"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-08-30",
   "closedAt": null,
   "updatedAt": "2026-08-30T12:00:00Z",
   "summary": "Socket found 19 Chrome and Edge extensions, from crypto price trackers and explorers to general tools like 'Enable Right Click & Copy' (70,000+ Chrome users), that loaded a modular malware framework. It drained EVM, Solana and Tron wallets by hijacking 'Connect Wallet' and 'Swap' buttons, swapped Ledger and Trezor sites for seed-phishing pages and stole exchange sessions; five extensions were bought from their original developers and turned malicious through updates. Socket thinks the campaign may date back to early 2024. Google removed the Chrome listings, but when BleepingComputer reported it on 30 August 2026 the Edge version of one was still available."
  }
 ],
 "changes": [
  {
   "incident": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "incidentTitle": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "severity": "medium",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-07",
   "title": "Socket published its analysis, linking the add-ons through a shared campaign marker to crypto-theft extensions it found in August 2026.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026"
  },
  {
   "incident": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "incidentTitle": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "severity": "medium",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-05",
   "title": "Mozilla unpublished the 16 malicious extensions from the Firefox add-ons store.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026"
  },
  {
   "incident": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "incidentTitle": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "severity": "high",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-08-30",
   "title": "BleepingComputer reported Socket's discovery of 19 malicious Chrome and Edge extensions; the Chrome versions were gone but one Edge version was still live.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026"
  }
 ]
}