Socket Finds 16 Fake Rabby and OKX Wallet Extensions on Firefox

The Firefox add-on ecosystem is proving a softer target than the browser stores users assume are curated, and impersonation of established wallet brands is a low-cost way to harvest seed phrases at scale. The detail that matters most is Socket's point that uninstalling the extension does not undo exposure — recovery-phrase compromise is permanent, so the real risk sits with anyone who installed these add-ons before Mozilla's takedown. Whether Mozilla's review process catches similar clones faster, and whether wallet makers push users toward verified distribution channels, is the open question.