Crypto Phishing Is Moving Inside the Platforms Users Already Trust

A Firefox campaign uncovered this week did more than impersonate crypto wallets. Some of the malicious extensions had previously existed under entirely different, apparently innocuous identities before later versions became credential- or wallet-stealing software.

That detail in the Firefox campaign points to a harder security problem than another batch of fake wallet add-ons. Attackers increasingly do not need every part of an attack to look fake. They can borrow trust from legitimate marketplaces, cloud platforms, advertising systems and software users already installed.

The evidence does not establish that this technique is increasing across all crypto phishing. But several recent campaigns show the same defensive problem: familiar trust signals can remain intact even after the dangerous part of the interaction has moved somewhere else.

A Trusted Extension Can Change After Installation

Socket identified 77 linked Firefox extension identities in its August 19 investigation, including 40 with confirmed malicious behavior and 37 deceptive sports-score applications connected through shared code, infrastructure and publishing patterns. Nine confirmed malicious identities had earlier versions that operated as sports-score shells before later builds under the same Firefox IDs became wallet malware. Other identities changed from utilities such as tab or link tools into malicious wallet-themed extensions.

That resembles the “extension hollowing” technique documented by Koi Security in its 2025 GreedyBear investigation, where publishers first created harmless-looking extensions and later repurposed established listings. The campaigns are not proven to involve the same operator, but the defensive problem is similar: installation-time reputation does not guarantee that the same extension identity will remain trustworthy.

Mozilla does subject Firefox extensions submitted for signing to automated review, with manual review possible, while Google says every Chrome Web Store submission — including updates — goes through its review system and that significant code changes can trigger closer scrutiny.

Those controls matter. They also do not eliminate the problem.

Socket found seven extensions whose packaged code could retrieve a remotely controlled destination from Supabase and load phishing content hosted through Cloudflare Pages. Changing the remote value could switch an extension between benign and phishing content without publishing a new extension version. Fifteen others sent stolen wallet secrets through attacker-controlled Cloudflare Worker deployments. Supabase and Cloudflare themselves were legitimate infrastructure; the attackers controlled specific projects running on them.

The URL Can Be Real and the Page Still Dangerous

The same inversion of trust appeared outside browser marketplaces.

In July, Huntress investigated a Mac user who searched Google for instructions to install Claude, clicked a sponsored result and landed on an actual claude.ai share page. The page was not a lookalike Claude domain. It was a genuine public page hosted under Anthropic’s domain and certificate, but its instructions ultimately directed the victim into a malware installation chain.

The attacker had effectively separated the trust signal from the malicious payload. Google supplied the advertising placement. Anthropic supplied the trusted page hosting. Cloud infrastructure handled later stages. None of those services had to be compromised for their legitimacy to help the lure.

Crypto users have already seen a simpler version of the same problem with malicious search ads placed above legitimate results. The Huntress case went further because even checking the destination domain would not have exposed the deception.

MacSync then attacked another familiar signal: already-installed software. Huntress found that the malware could replace wallet companion applications with modified versions that still appeared normal when opened but presented fraudulent recovery-phrase flows.

The question was no longer just, “Did the user download the correct wallet?” It became, “Is the wallet application running today still the software the user originally trusted?”

Old Phishing Advice Still Helps – but It Covers Less

Traditional advice is not suddenly useless. Installing wallets through official channels, avoiding unknown downloads and checking domains still blocks large classes of scams. MetaMask, for example, continues to recommend installing its extension through official stores, which provide automatic updates, integrity checks and signature protections. MetaMask’s guidance

The recent campaigns expose what those checks cannot answer alone.

A legitimate extension identity can be repurposed. A real domain can host attacker-created content. A reputable advertising network can deliver the first click. Legitimate cloud services can carry remote phishing pages or receive stolen data. Malware already on the device can modify an application that was originally installed correctly.

That shifts some of the security burden from origin to behavior and integrity.

For browser extensions, version changes and unexpected new behavior may matter as much as the original publisher page. Security products and enterprise policies can monitor what extensions actually connect to or do after installation instead of treating approval as permanent. Restricting remote content also reduces the ability to keep reviewed code benign while changing what users see later; Chrome’s Manifest V3, for example, prohibits remotely hosted executable code, specifically because remote code could bypass review.

For crypto users holding meaningful funds, compartmentalization also becomes more important: separating general browsing and software experimentation from the environment used to access wallets limits how far a successful lure can travel.

The underlying lesson from these incidents is narrower than “nothing can be trusted.” Platform reviews, official domains and signed applications still reduce risk. The problem is treating any of them as permanent proof of safety.

Modern phishing can preserve the trusted wrapper while replacing what happens inside it.