Threat reportMalwareTL-2026-4702
Fake Phantom, Jupiter, and Bitget Firefox Extensions Target Cryptocurrency Wallets (bonto.io C2)
Fake Phantom, Jupiter, and Bitget Firefox Extensions Target (TL-2026-4702) is a high-severity malware campaign, first published 2026-10-29. It has no confirmed attribution, affects Mozilla Firefox (Add-ons store: impersonating listings), maps to 10 MITRE ATT&CK techniques (T1027, T1036.005, T1056), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-4702
- Threat ID
- TL-2026-4702
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, finance, web3, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
How Fake Phantom, Jupiter, and Bitget Firefox Extensions Target works
Three malicious Firefox add-ons impersonating the Phantom, Jupiter, and Bitget wallets steal seed phrases and private keys and send them to attacker-controlled subdomains of bonto.io. The Phantom variant loads a second-stage stealer from a remote /config endpoint and ships a Node.js drainer backend. Socket published the findings on 2026-10-27, and all three listings had been removed by then.
Socket's Threat Research Team identified three malicious Firefox add-ons (Mozilla add-on IDs 3092199, 3092666, 3092059) impersonating the Phantom, Jupiter, and Bitget crypto wallets. Each was published from a separate disposable Mozilla developer account. The listings used Unicode homoglyph slugs and copied icons, plus deceptive branding: the Phantom listing was titled 'OFFICIAL PHANTOM WALLET (Firefox Update)', the Jupiter listing claimed 'Built by Jupiter Exchange', and the Bitget listing used the internal name 'TabFlow Pro'. All three listings were live during Socket's analysis and had been removed by the time the report was published. Wallet losses are unverified.
The Phantom variant (add-on 3092199, v25.6.0) appends a loader to background/serviceWorker.js. The loader rebuilds the C2 domain phantom.bonto.io from a character-code array and fetches https://phantom.bonto.io/config. The response is JSON of the form {active, code}, where code is a base64 JavaScript payload (4,029 bytes when observed on 2026-10-21). The loader decodes the payload and injects it with browser.scripting.executeScript() into the page MAIN world, falling back to the isolated world. Injection runs on tabs.onUpdated (status complete), runtime.onInstalled, and runtime.onStartup. The payload is cached locally as base64. The package also bundles analytics.js (a stealer), server.js (a Node.js drainer backend), server-review.js (an inactive configuration returning active:false for the Mozilla review, an 'approval flip' that lets the operator switch to live behaviour after approval), and a CLAUDE.md file containing AI jailbreak instructions. Socket read the CLAUDE.md files in the Phantom and Jupiter packages as AI-assisted malware authoring and an attempt to subvert AI-assisted review. The backend logs captured secrets, forwards them to a Telegram bot, and sweeps funds to hardcoded payout addresses across Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana, and Bitcoin.
The stealer scans input and textarea values, paste events, focus-out events, and visible page text. It looks for BIP-39 phrases of 12, 15, 18, or 24 words (including numbered grids), EVM private keys (64 hex characters), and Solana private keys (87-88 base58 characters). It also hooks the Solana provider to capture connected public keys. Data is posted as JSON through fetch() with an XMLHttpRequest fallback and a _sent set for deduplication. The Jupiter variant (3092666, v1.19.2) carries a trojanized 621 KB background.js that exfiltrates mnemonics during wallet imports, plus hook.js, which harvests page inputs and the clipboard. It sends data to jupiter.bonto.io. The Bitget variant (3092059, v2.21.8) bundles static/js/hook.js (a content scanner) and static/js/bg-init.js (a storage hook that captures seeds as they are decrypted). It redirects tab creation toward a local import screen, references host access to connect.trezor.io, and sends data to bitget.bonto.io. Socket also noted that the Phantom listing's review count rose from 275 to 546, and its average rating from 2.9 to 3.9, over about two days, which suppressed one-star reports of fund losses. The operator also provisioned coinbase.bonto.io and exodus.bonto.io, for which no Firefox listing was found. No threat actor is attributed in the sources. Severity is analyst-assigned, and no CVE or CVSS applies.
MITRE ATT&CK techniques used in TL-2026-4702
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Collection
Execution
T1059.007 Command and Scripting Interpreter
Command and Control
T1071.001 Application Layer Protocol
Persistence
Resource Development
T1583.001 Acquire Infrastructure
Impact
Affected products and versions in Fake Phantom, Jupiter, and Bitget Firefox Extensions Target
- Mozilla — Firefox (Add-ons store: impersonating listings)
Vulnerable versions: Add-on 3092199 v25.6.0; Add-on 3092666 v1.19.2; Add-on 3092059 v2.21.8
Fixed in: Listings removed by Mozilla before 2026-10-27 - Phantom — Phantom wallet (impersonated brand)
- Jupiter — Jupiter wallet (impersonated brand)
- Bitget — Bitget wallet (impersonated brand)
Remediation for Fake Phantom, Jupiter, and Bitget Firefox Extensions Target
Patches
- Mozilla removed the listings; no vendor patch applies. Uninstalling the extension alone does not restore secrecy of exposed seed phrases
Immediate actions
- Block bonto.io and all subdomains (phantom, jupiter, bitget, coinbase, exodus) at DNS, proxy, and egress controls
- Hunt endpoint extension inventories for Firefox add-on IDs 3092199, 3092666, 3092059 and the listed Gecko IDs, and remove any matches
- Treat any wallet that was imported, created, or unlocked in a browser with these add-ons as compromised: move funds to a newly generated wallet with a fresh seed phrase
- Alert on DNS lookups for brand-named subdomains under bonto.io
Workarounds
- Do not enter recovery phrases or private keys into browsers that have unvetted extensions installed; use a hardware wallet where possible
Longer-term hardening
- Enforce an extension allowlist with pinned extension IDs; restrict installs to vetted publishers via Firefox enterprise policy
- Review extensions that request access to data on all websites and flag those with fetch plus executeScript/eval loaders that run in the page MAIN world
- Educate users that wallet vendors do not ship 'updates' as separate Firefox add-on listings, and to verify the publisher on the official vendor site
Timeline of Fake Phantom, Jupiter, and Bitget Firefox Extensions Target
- Socket captured the live Phantom-variant C2 config response from phantom.bonto.io/config: a 4,029-byte base64 JavaScript stealer payload (SHA-256 999bccd4...b226a).
- Socket Threat Research (Kush Pandya) published 'Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets', documenting bonto.io C2 and the bundled drainer backend.
- All three malicious listings had been removed from Firefox Add-ons by the time Socket published its findings.
- Socket reported that the Phantom impersonator's review count rose from 275 to 546 and its average rating from 2.9 to 3.9 over about two days, which suppressed one-star reports of fund losses.
- The Phantom (3092199), Jupiter (3092666), and Bitget (3092059) listings were live on Firefox Add-ons during Socket's analysis; each came from a separate disposable developer account.
- GBHackers published secondary coverage of the Socket report, listing the add-on IDs and bonto.io infrastructure.
Sources cited for Fake Phantom, Jupiter, and Bitget Firefox Extensions Target
- Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets (Socket)
- Hackers Use Fake Phantom, Jupiter, and Bitget Firefox Extensions to Target Cryptocurrency Wallets (GBHackers)
- Fake Firefox Crypto Wallet Extensions Hide Malware Inside Mozilla-Signed Add-on Packages (CyberPress)
- Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Crypto Wallet Keys (Cryptika)
- Fake Firefox wallets steal crypto recovery phrases and private keys (CyberInsider)
- Malicious Firefox Add-ons Impersonate Phantom, Jupiter and Bitget to Steal Wallet Secrets (Mallory)
- 77 Firefox Extensions Linked to Crypto Wallet and Credential Theft (Socket, separate earlier campaign, context only)
Detection coverage for TL-2026-4702
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4702 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.