Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
16 Firefox Extensions Caught Stealing Crypto Wallet Recovery Phrases and Private Keys
Malware Families
Excerpt
Threat Research has uncovered a coordinated campaign involving 16 malicious Firefox extensions designed to steal cryptocurrency wallet recovery phrases and private keys. The extensions pose as wallet portals, desktop utilities, and browser tools, directing sensitive wallet information to attacker-controlled Cloudflare Workers . The campaign includes four large Rabby Wallet clones and twelve smaller extensions using interfaces that resemble OKX Wallet. Rather than exploiting a…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | icy-star-f45c.workers.dev | High | Score 58/100 | First seen |
| Domain | silent-wind-get.icy-star-f45c.workers.dev | High | Score 58/100 | First seen |
| SHA1 | 8bcab07d51e4fd99b9ab6826c73c267c4796ad8f | Medium | Score 53/100 | First seen |
| Domain | fondationanimalaidrelief.workers.dev | High | Score 58/100 | First seen |
| Domain | small-boat-969c.icy-star-f45c.workers.dev | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…