Researchers have uncovered 16 malicious Mozilla Firefox extensions designed to steal cryptocurrency wallet recovery phrases and private keys. These extensions masquerade as legitimate wallet portals, desktop utilities, and browser tools. Their code intercepts sensitive information during wallet import flows and exfiltrates it to attackers. This campaign highlights the ongoing threat of malicious browser extensions targeting cryptocurrency users.