A Warning for Crypto Users: Fake Browser Extension Mimicking OKX Exchange Found on Firefox Store
A fake browser extension mimicking cryptocurrency exchange OKX has infiltrated the Firefox browser store.
What Happened?
On Jan. 8, OKX’s official Chinese X account issued a warning about a malicious browser extension listed on the Firefox plugin store. The company clarified that they have not developed an official browser plugin.
Understanding Browser Extensions
Browser extensions are small software programs that enhance a browser’s functionality by adding features or tools. The Firefox browser store serves as a platform for users to download these extensions.
The Risks of Malicious Extensions
Crypto scammers often infiltrate these stores by creating developer accounts and bypassing quality and security standards. This allows them to publish malicious extensions that can deceive users, compromise sensitive information, and even drain wallets.
OKX’s Response
OKX warned users to secure any funds stored in wallets connected with the extension to avoid losses. They urged users to only download software from the exchange’s official website and social media channels.
Current Situation
The exchange has requested the removal of the fraudulent extension from Firefox. However, the extension remained live on the browser store at press time and had already been downloaded by 95 users. It is unclear whether any users have suffered losses as a result.
The Deception
Scammers made the plugin hard to spot by using the actual OKX branding, a developer account named after the exchange, and fake five-star reviews. However, subtle inconsistencies in the description and wording can serve as red flags for users.
Past Incidents
Malicious extensions have led to severe losses for crypto users in the past. In one instance, a user lost $800,000 due to key logging plugins targeting crypto wallets. Crypto exchanges and related tools are prime targets for scammers looking to steal sensitive information.
In a report by cybersecurity firm Group-IB, bad actors like North Korea’s Lazarus group were found to be targeting browser extensions such as MetaMask, Coinbase, and TON Wallet.