More than 40 fake Wallet extension programs have emerged, stealing mnemonic phrases and threatening users' asset security.

[Coin World] Coin World reported on July 2 that the security company Koi discovered over 40 counterfeit encryption Wallet extension programs in a certain browser's official plugin store, imitating several mainstream Wallets. These malicious plugins steal input content exceeding 30 characters (mainly targeting mnemonic phrases) by implanting event listener code and send the data back to the attacker's server.

Research shows that the phishing activity has been ongoing since at least April 2025, with the behind-the-scenes group suspected to be a Russian hacker organization. The malicious plugins not only misuse legitimate brand logos but also enhance credibility through a large number of fake five-star reviews. Although some users have exposed the scam through one-star ratings, the download numbers for most of the counterfeit plugins remain significantly abnormal. Despite the browser having an automated risk detection system, a large number of reported malicious plugins have still not been removed as of the time of publication. Researchers remind users to verify developer information and the authenticity of download numbers when installing wallet extensions.