Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
25 IOCs
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials
Threat Actors
Malware Families
Excerpt
Socket Threat Research identified a coordinated campaign of 16 Firefox extensions targeting cryptocurrency wallet users. The extensions masquerade as wallet portals, desktop utilities, and browser tools, but their code intercepts recovery phrases and private keys during wallet import flows and attempts to send those secrets to attacker-controlled Cloudflare Workers. The campaign is a cryptocurrency wallet credential-stealing operation with a variety of lures: Four large…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(4)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →25 indicators
IOC Relationship Graph
Building graph…