Odaily Planet Daily News Security company Koi disclosed that more than 40 fake crypto wallet extensions appeared in the official plug-in store of Firefox browser, impersonating mainstream wallets such as MetaMask and Coinbase Wallet. These malicious plug-ins steal input content of more than 30 characters (mainly for mnemonics) by implanting event monitoring code and send the data back to the attacker's server. Investigations show that the phishing campaign has been going on since at least April 2025, and the group behind it is suspected to be a Russian hacker group. (BleepingComputer)