# Fake Phantom, Jupiter, and Bitget Firefox Extensions Target Cryptocurrency Wallets (bonto.io C2)

> Three malicious Firefox add-ons impersonating the Phantom, Jupiter, and Bitget wallets steal seed phrases and private keys and send them to attacker-controlled subdomains of bonto.io. The Phantom variant loads a second-stage stealer from a remote /config endpoint and ships a Node.js drainer backend. Socket published the findings on 2026-10-27, and all three listings had been removed by then.

- **Published:** 2026-10-29T04:29:00Z
- **Last reviewed:** 2026-10-29T04:29:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4702
- **ID:** TL-2026-4702
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Socket's Threat Research Team identified three malicious Firefox add-ons (Mozilla add-on IDs 3092199, 3092666, 3092059) impersonating the Phantom, Jupiter, and Bitget crypto wallets. Each was published from a separate disposable Mozilla developer account. The listings used Unicode homoglyph slugs and copied icons, plus deceptive branding: the Phantom listing was titled 'OFFICIAL PHANTOM WALLET (Firefox Update)', the Jupiter listing claimed 'Built by Jupiter Exchange', and the Bitget listing used the internal name 'TabFlow Pro'. All three listings were live during Socket's analysis and had been removed by the time the report was published. Wallet losses are unverified.

The Phantom variant (add-on 3092199, v25.6.0) appends a loader to background/serviceWorker.js. The loader rebuilds the C2 domain phantom.bonto.io from a character-code array and fetches https://phantom.bonto.io/config. The response is JSON of the form {active, code}, where code is a base64 JavaScript payload (4,029 bytes when observed on 2026-10-21). The loader decodes the payload and injects it with browser.scripting.executeScript() into the page MAIN world, falling back to the isolated world. Injection runs on tabs.onUpdated (status complete), runtime.onInstalled, and runtime.onStartup. The payload is cached locally as base64. The package also bundles analytics.js (a stealer), server.js (a Node.js drainer backend), server-review.js (an inactive configuration returning active:false for the Mozilla review, an 'approval flip' that lets the operator switch to live behaviour after approval), and a CLAUDE.md file containing AI jailbreak instructions. Socket read the CLAUDE.md files in the Phantom and Jupiter packages as AI-assisted malware authoring and an attempt to subvert AI-assisted review. The backend logs captured secrets, forwards them to a Telegram bot, and sweeps funds to hardcoded payout addresses across Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana, and Bitcoin.

The stealer scans input and textarea values, paste events, focus-out events, and visible page text. It looks for BIP-39 phrases of 12, 15, 18, or 24 words (including numbered grids), EVM private keys (64 hex characters), and Solana private keys (87-88 base58 characters). It also hooks the Solana provider to capture connected public keys. Data is posted as JSON through fetch() with an XMLHttpRequest fallback and a _sent set for deduplication. The Jupiter variant (3092666, v1.19.2) carries a trojanized 621 KB background.js that exfiltrates mnemonics during wallet imports, plus hook.js, which harvests page inputs and the clipboard. It sends data to jupiter.bonto.io. The Bitget variant (3092059, v2.21.8) bundles static/js/hook.js (a content scanner) and static/js/bg-init.js (a storage hook that captures seeds as they are decrypted). It redirects tab creation toward a local import screen, references host access to connect.trezor.io, and sends data to bitget.bonto.io. Socket also noted that the Phantom listing's review count rose from 275 to 546, and its average rating from 2.9 to 3.9, over about two days, which suppressed one-star reports of fund losses. The operator also provisioned coinbase.bonto.io and exodus.bonto.io, for which no Firefox listing was found. No threat actor is attributed in the sources. Severity is analyst-assigned, and no CVE or CVSS applies.

## MITRE ATT&CK

- T1583.001 Domains
- T1176.001 Browser Extensions
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1059.007 JavaScript
- T1071.001 Web Protocols
- T1056 Input Capture
- T1657 Financial Theft

## Sources

- [Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets (Socket)](https://socket.dev/blog/firefox-wallet-impersonators)
- [Hackers Use Fake Phantom, Jupiter, and Bitget Firefox Extensions to Target Cryptocurrency Wallets (GBHackers)](https://gbhackers.com/cryptocurrency-wallets-targeted/)
- [Fake Firefox Crypto Wallet Extensions Hide Malware Inside Mozilla-Signed Add-on Packages (CyberPress)](https://cyberpress.org/firefox-wallets-hide-malware/)
- [Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Crypto Wallet Keys (Cryptika)](https://www.cryptika.com/malicious-firefox-extensions-impersonate-phantom-jupiter-and-bitget-to-steal-crypto-wallet-keys/)
- [Fake Firefox wallets steal crypto recovery phrases and private keys (CyberInsider)](https://cyberinsider.com/fake-firefox-wallet-extensions-steal-crypto/)
- [Malicious Firefox Add-ons Impersonate Phantom, Jupiter and Bitget to Steal Wallet Secrets (Mallory)](https://mallory.ai/stories/01a17f0a-f487-761c-82f7-325b96c3ceef)
- [77 Firefox Extensions Linked to Crypto Wallet and Credential Theft (Socket, separate earlier campaign, context only)](https://socket.dev/blog/firefox-crypto-wallet-theft)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4702