Safety

Socket Identifies 16 Fake Rabby and OKX Wallet Extensions on Firefox

October 23, 2026, 10:52 AM UTC (1 day ago) · 1 source · Summarized by CryptoBipto

Security firm Socket has discovered 16 fraudulent browser extensions on Firefox that impersonate the Rabby and OKX cryptocurrency wallet extensions. These fake extensions could potentially be used to steal users' funds or private keys by mimicking legitimate wallet software.

WHY IT MATTERS

Browser extensions are small programs you add to your web browser to get extra features, like a cryptocurrency wallet. Think of fake wallet extensions like a counterfeit ATM placed in a shopping mall — it looks real, but when you type in your PIN (or in crypto terms, your seed phrase or private key), the scammers capture that information and can steal your money. A seed phrase is a set of words that acts as a master password to your crypto wallet. This discovery is a reminder that even official browser extension stores can host malicious software, and users should always verify they are downloading wallet extensions from the official project website rather than searching for them directly in the store.

Socket, a cybersecurity firm focused on software supply chain threats, has identified 16 malicious browser extensions on Mozilla Firefox that pose as legitimate Rabby Wallet and OKX Wallet extensions.

Read the full analysis with a CryptoBipto membership

Members can read the full analysis of every story, not just the headline.

Get started

SOURCES

thedefiant.io

Browser SecurityFake ExtensionsWallet SafetyPhishing

Learn the concepts behind this

Clear explanations of the subjects this article touches, with every term defined.

How do crypto scams work, and how do you avoid them?The common crypto scams and attacks explained in simple terms — phishing, rug pulls, Ponzi schemes, market manipulation — and the risks worth checking before you act.