A malicious Firefox (opens in new tab) add-on named "Safepal Wallet" managed to stay listed on the official Mozilla add-ons website for seven months as it scammed users by emptying out their cryptocurrency wallets (opens in new tab).
However, while the wallet does have official smartphone apps available for both Apple AppStore (opens in new tab) and Google Play Store (opens in new tab), the website doesn’t list any browser extensions.
We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.
>> Click here to start the survey in a new window (opens in new tab) <<
- Take a look at the best web browsers (opens in new tab)
- Here’s our list of the best VPN services (opens in new tab)
- These are the best password managers (opens in new tab)
“After I installed this extension and logged in with my credentials it was not working,” reported (opens in new tab) Firefox user Cali, adding that when they checked back about 8 hours later, their cryptos worth around $4000 had been transferred to another wallet.
Within five days of Cali's public report of the incident this month, a Mozilla spokesperson responded (opens in new tab) saying that they were investigating the incident, before dropping the fake add-on’s listing.
Reporting on the development, BleepingComputer explains that in order to publish an add-on on Mozilla's add-ons website, developers must follow a submission process (opens in new tab) that states submitted add-ons are "subject to review by Mozilla at any time."
However, the extent of such a review isn’t specified, nor has Mozilla explained how the fake add-on managed to get listed.
Furthermore, while the malicious browser add-on has been taken down, BleepingComputer reports that the phishing (opens in new tab) website set up by the threat actors is still up.
The website asks users for their secret twelve-word backup phrase in order to pair the SafePal wallet, which is then silently sent to the threat actor behind the fake extension.
- Shield yourself with these best identity theft protection services (opens in new tab)
Via BleepingComputer (opens in new tab)