According to online reports, security company Koi disclosed that more than 40 counterfeit cryptographic wallet extensions have appeared in the official Firefox browser plug-in store, including mainstream wallets such as MetaMask and Coinbase Wallet. These malicious plug-ins steal more than 30 characters of input (mainly for mnemonic words) by implanting event-listening code and send the data back to the attacker's server. Investigation shows that the phishing activity has continued since at least April 2025, and the behind-the-scenes gang is suspected of being a Russian-language hacker organization.