October 10, 2026
- Crypto wallet extensions, two clusters: 16 malicious Firefox add-ons impersonating Rabby and OKX intercept recovery phrases and private keys during import flows (The Hacker News), and Unit 42 found nine extensions advertised as simple utilities that render as wallets on open, targeting both hot and hardware wallets (Unit 42). · Threat Activity
in Fake "Security Audit" Workflows Sweep GitHub for Cloud and AI Keys