Sixteen Fake Firefox Wallet Extensions Copied Rabby and OKX: What to Do If You Typed in a Recovery Phrase

On Oct. 7, 2026, the security firm Socket reported 16 Firefox extensions built to steal crypto wallet recovery phrases and private keys. Four copied the Rabby wallet and twelve copied OKX Wallet's look. Socket says Mozilla had unpublished the extensions as of Oct. 5. This article covers what the report found, why a changed password does not undo the damage, and how to respond if you may have used one.

What Socket found

According to Socket's Threat Research team, the four larger extensions imitated the Rabby wallet and used the misspelled brand name "Raabby WaIIet," written with capital I letters in place of the two Ls. The twelve smaller ones imitated an OKX-style wallet under the name "Portal WALLET." Socket says both groups hooked into the wallet's import screens, copied what users typed there and sent it to a server controlled by the attacker.

• The Rabby clones captured recovery phrases and private keys entered during import and when a password-protected wallet was created.
• Most OKX clones captured 12- or 24-word recovery phrases. One of the twelve did not work as packaged because of a configuration error, which Socket describes as a delivery defect and not as evidence of good intent.
• Every extension's manifest, the file that declares what an extension collects, said it collected no data, which Socket says contradicts what the code does.

Socket assesses with high confidence that this activity continues a campaign it described in an earlier August 2026 report. The report does not give a number of victims or a total of funds lost, so the scale of harm is unknown.

Why changing a password does not fix it

A recovery phrase, also called a seed phrase, is the 12 or 24 words that generate every account in a wallet. A private key controls a single account. Anyone who has either can move the funds from any device, at any time. A wallet extension's password only locks the copy of the wallet stored in your browser. Socket states that changing the extension password does not invalidate a stolen recovery phrase or private key.

If you entered a real recovery phrase or private key

Socket's recommendations for affected users, which match general wallet security practice, are:

1. Disconnect the device from wallet activity and remove the malicious extensions.
2. On a clean device, create a new wallet with a new recovery phrase.
3. Move assets to the new wallet and revoke token approvals tied to the exposed wallet. An approval is permission you gave a smart contract to spend your tokens.
4. Treat every account derived from the exposed phrase as compromised.
5. Check every other Firefox browser you use, because extensions can sync between devices.

The report does not say whether Firefox also removes already installed copies after an extension is unpublished from the store, so check your own Add-ons page rather than assume. If you only searched for these wallets or never typed a phrase into them, the report gives no basis to think your funds were taken.

How to check an extension before you trust it

Mozilla's guidance on assessing extension safety says its store scans submissions for common issues and may add human review, but that neither process guarantees an extension is safe. Its questions are a useful checklist:

• Is the extension from a brand or developer you trust, and does the developer's own website point to this listing? Start from the wallet maker's official website, not a search result or ad.
• Do the permissions requested match what a wallet needs, and does the listing explain them?
• Does the extension have a privacy policy, a history of reviews and a sensible number of users?

Mozilla also runs a Recommended Extensions program in which staff security experts review each extension. Mozilla notes that an extension that is not Recommended is not necessarily unsafe, only that Mozilla has not vetted it.

Two habits limit the damage from any fake wallet. Never type a recovery phrase into a new extension unless you started from the wallet maker's official site and you intend to restore that wallet. Keep large balances on a hardware wallet, where the phrase is never typed into a browser.

What the report does not say

Socket is a security company, and its findings come from analyzing the extension code. This article did not independently test the extensions. The report concerns Firefox and does not claim that other browsers or the real Rabby and OKX wallets are affected. The user counts Socket gives for the real products describe those products, not victims. Mozilla's own account of the removals was not part of the material reviewed.

Disclosure: This article summarizes Socket's Oct. 7, 2026 report and Mozilla's published extension guidance. Socket's findings come from its own code analysis, which was not independently reproduced here, and no victim count is available. The featured illustration is AI-generated and conceptual. This article is not financial, legal, or investment advice. AI-assisted research and writing. Cited sources, not AI alone, support the claims.