Post

Socket found 16 malicious Firefox extensions impersonating Rabby and OKX wallets, built to steal recovery phrases and private keys. All 16 claim to collect no data. The malware sends wallet secrets to attacker-controlled Cloudflare Workers. socket.dev/blog/firefox...

socket.dev16 Malicious Firefox Extensions Steal Cryptocurrency Wallet CredentialsSocket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

7/10/26, 5:53 pm1 repost5 likes

PDFops

@pdfops.dev

free workers plus your own subdomain is basically disposable, trusted-looking C2 infra. anything accepting webhooks on workers should be verifying request signatures, not just trusting that the origin is 'cloudflare so it's fine.'

Socket

@socket.dev

cc: @campuscodi.risky.biz @darkreading.bsky.social @coindesk.com @cointelegraph.bsky.social @theblock.bsky.social @coingapenews.bsky.social @thehackernews.bsky.social @bleepingcomputer.com