OTX Threat: Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets

Three malicious Firefox extensions impersonating popular cryptocurrency wallets—Phantom, Jupiter, and Bitget—were discovered stealing recovery phrases and private keys from users. The extensions use Unicode homoglyphs to mimic legitimate wallet names and route stolen credentials to brand-named subdomains of bonto[.]io. The Phantom impersonator employs a two-stage approach: a loader fetches additio