# 16 Fake Rabby and OKX Wallet Extensions Targeted Firefox Users

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/39489
Published: 2026-10-24T00:59:43.000Z
Updated: 2026-10-24T00:59:43.000Z
Section: Technology

> Mozilla had unpublished the add-ons by Oct. 5. One OKX variant’s normal packaged flow failed because of defects in its manifest and message routing.

Sixteen Firefox add-ons impersonating Rabby Wallet and OKX Wallet targeted wallet imports with code designed to capture recovery phrases and private keys, putting users of functioning variants at risk.

Four extensions imitated Rabby Wallet and 12 presented OKX Wallet interfaces. Mozilla had unpublished all 16 by Oct. 5.

The extensions targeted wallet-import screens and carried code to collect credentials and send them to attacker-controlled Cloudflare Workers. Their Firefox manifests declared that they collected no data, even though the extensions contained code to collect wallet credentials.

One OKX variant still contained code to collect and transmit secrets, but its normal packaged flow did not function: its manifest failed to load the background script, and the frontend and background script used mismatched message names.

Anyone who entered a real recovery phrase or private key into a functioning variant should treat the wallet as compromised, create a new wallet in a clean environment and move the assets. Removing the add-on does not secure credentials that may already have been exposed.