Cyber Insider reports that a network of 77 Firefox extensions has been discovered, with a significant portion actively engaged in cryptocurrency wallet theft, credential harvesting, and deceptive software distribution.Socket researchers identified 40 malicious extensions and 37 others disguised as unrelated utilities, all linked through shared code, infrastructure, and publishing artifacts. The operation, active from at least March to August, saw extensions impersonating crypto products and acting as phishing loaders. Some extensions embedded wallet-theft code directly, stealing recovery phrases during wallet creation or import, while others transmitted serialized keyring information before local encryption. Additionally, 13 extensions…







