Socket Finds 16 Fake Rabby and OKX Wallet Extensions on Firefox

Security firm Socket identified 16 Firefox extensions designed to steal wallet recovery phrases and private keys through counterfeit Rabby and OKX interfaces, and said Mozilla had unpublished them by Oct. 5.

In an Oct. 7 report, Socket described code that intercepted secrets during wallet imports and attempted to send them to attacker-controlled Cloudflare Workers endpoints. An exposed recovery phrase lets an attacker restore a wallet elsewhere and transfer its assets; removing the extension does not revoke that access.

Socket did not provide installation totals, affected-user counts or a stolen-funds estimate in its report.

The researchers identified four Rabby clones and 12 OKX-style clones disguised as wallet portals, desktop utilities and browser tools. The Rabby clones used the altered branding `Raabby WaIIet` and retained much of the underlying wallet application, allowing legitimate-looking operations to continue alongside the theft code, according to Socket.

The Rabby variants placed raw recovery phrases or private keys in the query parameters of outgoing web requests. Functioning OKX-style variants passed 12- or 24-word phrases from their import screens to background scripts programmed to transmit them to remote endpoints, the researchers said.

One of the 16 packages, `sipoo-grozza@browserweb.com`, was broken as shipped: its background script was not loaded, and its frontend and background message types did not match. Socket said it contained secret-stealing code but could not operate through its normal packaged flow.

A Returning Campaign

Socket assessed the extensions as a continuation of a campaign it reported in August, citing reused infrastructure, code and a shared campaign marker. That earlier investigation tracked 77 linked Firefox extensions: 40 confirmed as malicious and 37 deceptive sports-score shells without confirmed wallet- or credential-stealing payloads in the analyzed builds.

The latest report says every extension declared that it collected no data, despite the credential-handling code Socket found.

Mozilla has previously described automated risk screening followed by human review for suspicious wallet extensions. In a May 2025 explanation of those controls, it said extensions found to be malicious were blocked immediately. That explanation predates both Socket reports.

Removing the Add-On Is Not Enough

Rabby had already announced in May 2025: “The Rabby Wallet Firefox extension will no longer be maintained.” It recommended Chrome or Brave instead.

OKX's standing anti-phishing guidance warns about counterfeit browser extensions and recommends obtaining extensions from developers' official websites or other reliable sources. Mozilla similarly advises users to follow the extension link on their wallet provider's own website.

Socket's report includes the full list of 16 extension IDs. It recommends removing the listed extensions and, for anyone who entered a real recovery phrase or private key into a functioning variant, creating a new wallet with a new recovery phrase on a clean device and moving assets. Changing the extension password does not invalidate a stolen recovery phrase or private key.