Browser extensions are a convenience, but they can also be a backdoor. Security researchers have flagged a batch of malicious Firefox add-ons that pose as normal tools — password managers, crypto wallets, note takers, or sports trackers — while quietly extracting cryptocurrency wallet seed phrases and stored browser credentials. The discovery highlights how a single extension install can hand a remote attacker the keys to your digital assets and online accounts.
According to the report, these add-ons are designed to siphon seed phrases, the recovery words for crypto wallets, which would give an attacker complete control over the wallet. The same malware also targets saved credentials in the browser, meaning any account with stored passwords — email, banking, or social media — could be compromised. The threat is not a flaw in Firefox itself but in the trust users place in third-party extensions.
The advice from the source is straightforward: treat every extension with suspicion. Review the permissions it requests, stick to well-known publishers, and remove any add-on you no longer use. If you suspect a compromised extension, change your passwords and move funds to a fresh wallet. The risk is real, and the cost of a careless install can be severe.