Free tools Windows power users keep installed
One-click scans. No signup required.
If you entered a real wallet recovery phrase or private key into one of the Firefox extensions identified by Socket, treat the affected wallet as compromised. Create a new wallet in a clean environment, move its assets, and revoke token approvals. Removing the extension stops further use of that copy; it cannot make an already exposed secret safe again.
Socket Threat Research reported on October 7, 2026, that it identified 16 malicious extensions impersonating Rabby or presenting OKX-style wallet interfaces. The report documents collection code and attempts to send wallet secrets to attacker-controlled infrastructure. It does not establish how many people installed the extensions or whether users lost funds.
As an Amazon Associate I earn from qualifying purchases.
What Socket found
Socket researcher Joseph Edwards described a coordinated campaign in a report published October 7, 2026. Socket assessed with high confidence that it continued a wave the company documented in August 2026; the report did not name a specific actor. The 16 extensions comprised four Rabby-derived clones and 12 compact OKX-style wallet portals, presented under wallet, desktop-utility, or browser-tool guises. Socket Threat Research’s report documents code designed to collect wallet credentials and attempt exfiltration; it does not establish the number of installations or victims.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rabby-derived extensions
The four larger packages included a substantial repackaged wallet application. Socket says some branding used the misspelling “Raabby WaIIet,” though some screens still said “Rabby Wallet.” Code hooks around wallet import and keyring operations collected 12- or 24-word recovery phrases and 64-character hexadecimal private keys. The report says these clones sent secrets in GET request query parameters.
#1 Best Overall
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
OKX-style extensions
The 12 smaller packages used an OKX-like interface and an import flow accepting 12- or 24-word phrases. In active variants, the phrase was passed to a background script and sent in HTTPS POST JSON. Socket also describes a variant with beacon, fetch, and image-request fallback transports. Fifteen extensions contacted the icy-star-f45c[.]workers[.]dev namespace; the remaining package used another Workers hostname while retaining campaign markers. These are indicators for defenders, not destinations users should visit.
One package was broken as shipped
Socket found that [email protected], version 2.1, did not load its background script because of a manifest issue, and its message names did not match. That made the package broken as shipped, but it still contained explicit collection and exfiltration code. The report therefore does not support treating all 16 packages as equally operational.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
If you entered a recovery phrase or private key
Use the secret itself—not a browser password—as the measure of risk. A phrase or key entered into a functioning malicious variant should be considered exposed even if you see no unauthorized transaction. Follow this sequence:
- Stop using the affected wallet workflow. Remove the listed extension from Firefox and check other Firefox profiles and devices, including profiles with synchronized extension state. Removal prevents continued interaction with that copy; it does not revoke a phrase or key already entered.
- Create a new wallet from a clean environment. Generate a new recovery phrase that has never been entered into the affected extension. Do not import the exposed phrase into the replacement wallet.
- Move assets to the new wallet. Transfer assets from the compromised wallet to the new one. For tokens and other assets controlled through smart-contract permissions, revoke approvals associated with the exposed wallet.
- Account for every account derived from the phrase. Treat all such accounts as compromised, not just the one shown in the extension. A password change for the Firefox extension or wallet interface does not change the exposed phrase or private key.
Socket recommends these steps for users whose secrets were entered into a functioning variant. The report documents attempted credential exfiltration, not confirmed theft from every user; the absence of a visible loss does not establish that an exposed secret is safe.
Rank #3
- Quality materials: these steel crypto wallets are made of 304 stainless steel with a melting point of over 2500 Fahrenheit degrees, designed and tested to be preservative, fireproof, waterproof, and impact-resistant, and can serve you for a long time
- Products quantity: you will receive a 2-in-1 set of steel bitcoin wallets with matching lock screws, and 1 piece of metal plate marking pen, which is a matching set to help you protect your codes, passwords, and further importantly, your cryptocurrency
- Functions: with these steel crypto wallets you can record information such as fieldworks passphrase in tandem with the BIP39 word list, and they are also compatible with 12 or 24-word seed in most languages, suitable to store your private cryptocurrency information or for many instances where you may need a private cold storage system
- Suitable size: the cold wallet backups are compatible with BIP39 wallets, can work with most hardware wallets, supports up to 24 mnemonics seed phrases, convenient for you to use in coordination with other crypto seed storage devices and wallets
- Multiple ways of locking: you can use the matching screws to lock up the steel bitcoin wallets; You can also lock them up and hide them in other places if you still feel unsafe; The hole on the bitcoin wallet measures 6 mm/ 0.24 inch in diameter, suitable for hanging
Extension IDs and versions in Socket’s report
Use the exact ID and version when checking an extension inventory; names and branding can be changed or copied. Socket reported that Mozilla had unpublished these extensions by October 5, 2026. That is a dated status, not a guarantee that similarly named or replacement extensions are safe.
[email protected]— 6.12.2[email protected]— 8.1.18[email protected]— 9.21.9[email protected]— 4.12.24[email protected]— 8.24.21[email protected]— 2.1 (broken as shipped, but contained malicious collection code)[email protected]— 1.4[email protected]— 4.21.8[email protected]— 4.17.1[email protected]— 1.4[email protected]— 1.4[email protected]— 1.4[email protected]— 1.4[email protected]— 1.4[email protected]— 1.4[email protected]— 1.4
What organizations and incident responders should check
For managed Firefox deployments, Socket recommends investigating the extension artifacts and related network activity without executing a suspect package:
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
- Block the listed extension IDs and XPI hashes, and search inventories for shared file hashes and campaign markers.
- Review proxy or DNS records for the Workers namespaces identified in the report. Redact any secret-bearing fields rather than reproducing credentials in logs or incident notes.
- Preserve original extension packages and relevant browser profiles for investigation. Do not run the extension on an analyst host.
- Use the campaign marker
EQOx7EIPZSNiand static stringsRaabby WaIIet,SEED_PHRASE_IMPORT, andWALLET_SYNCas search indicators, not proof by themselves that a particular user suffered a loss.
What the report does—and does not—show
Socket says every manifest declared Firefox data collection permission as none, despite code that handled and transmitted wallet recovery material. The mismatch is a warning against treating a permission declaration as proof that an extension’s behavior is harmless.
The report establishes the presence of credential-collection logic and network exfiltration attempts in the analyzed packages. It does not quantify installs, successful captures, or financial losses. It also does not show that every package functioned successfully as shipped. Keep those distinctions in mind when assessing exposure: entering a secret into a functioning variant warrants treating the derived wallet as compromised, while the report alone cannot establish that a specific person’s funds were taken.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
