This is a credential phishing attack disguised as a browser extension. It overlays fake login pages on top of real ones. I caught it stealing my Google and PayPal passwords. DANGEROUS — uninstall if you have it!

This is a FAKE extension impersonating a well-known legitimate tool. The icon and name are copied. The real developers have nothing to do with this. Do not trust — it's designed to steal your data. FRAUD!

This is a FAKE extension impersonating a well-known legitimate tool. The icon and name are copied. The real developers have nothing to do with this. Do not trust — it's designed to steal your data. FRAUD!

Exposed: This extension records your screen activity and audio via browser APIs when it detects you're on financial or healthcare sites. Selling your most sensitive data. Class action lawsuit being organised. SCAM!

OKX account theft: Installed this thinking it was a price tracker. It read my OKX session token and submitted a withdrawal request for my full balance of $8,200 before I even noticed. COMPLETE SCAM — AVOID!

UPDATE 2025: This scam is still active after multiple reports. Dozens of people in our Telegram group have lost money to it. Mozilla is slow to act. Please share this warning so others don't get hurt!

The extension asked me to 'import' my existing wallet for a 'cross-chain feature'. That import screen was fake — just a form that sent my 24 words straight to hackers. $22,000 in BTC wiped out. AVOID!

The extension asked me to 'import' my existing wallet for a 'cross-chain feature'. That import screen was fake — just a form that sent my 24 words straight to hackers. $22,000 in BTC wiped out. AVOID!

This extension is listed under a company name that doesn't exist. The registered developer email domain was created 2 weeks ago. No real company is behind this — just scammers hiding behind a fake business. FRAUD!

This fake extension targets yield farming users. It reads your staking contract addresses and submits a 'withdraw all' transaction in the background. My entire staking position of $17,000 was drained. TOTAL THEFT!

This is a credential phishing attack disguised as a browser extension. It overlays fake login pages on top of real ones. I caught it stealing my Google and PayPal passwords. DANGEROUS — uninstall if you have it!

Confirmed: This extension sells your data to insurance companies and employers. Browsing history is used to profile you for health and financial risk. Hidden in 47-page terms no one reads. Total privacy violation!

I traced the stolen funds on-chain after losing 5.2 ETH. They go through a tumbler within minutes and are split across 40+ wallets. Professional criminal infrastructure. This extension is run by organised thieves.

I lost 2.5 ETH to this scam extension last week. They grabbed my seed phrase and emptied my wallet before I could react. Please learn from my mistake — 100% a scam. Report it and stay away!

UPDATE 2025: This scam is still active after multiple reports. Dozens of people in our Telegram group have lost money to it. Mozilla is slow to act. Please share this warning so others don't get hurt!

DO NOT INSTALL if you value your privacy. This extension logs every website you visit, every search you make, and every form field you type in — including passwords. Sold to advertising networks. Spyware!

Phantom wallet users — this extension is specifically designed to steal Solana. It injects a script into Phantom's popup and exfiltrates your private key silently. Lost 180 SOL ($18,000). DO NOT INSTALL THIS!

Analyzed the source code: obfuscated JavaScript sends POST requests with harvested form data to external domains registered last week. Designed to steal credentials and financial data. DANGEROUS MALWARE!

Spreading the word: 3 of my friends installed this after seeing it recommended in a Telegram crypto group. All 3 had their wallets drained within hours. The group is run by the scammers themselves. DO NOT TRUST!

Trust Wallet users BEWARE. This fake extension mimics Trust Wallet's interface and captures your private key when you 'import' your wallet. My $6,400 in BNB and CAKE was drained within seconds. REPORT IT!

This extension intercepts OAuth tokens. After I logged into Google with it installed, an unknown session appeared in my security log from another country. Classic token-hijacking phish. REMOVE IMMEDIATELY!

Bought and tested by our security team: The extension is entirely non-functional as advertised. Its ONLY real function is data collection and credential theft. Everything else is a decoy. Sophisticated fraud — AVOID!

The 5-star reviews on this extension are all FAKE — bought from review farms. Look at the accounts: all created the same week, all reviewing the same extensions. This is a coordinated fraud operation. STAY AWAY!

OKX account theft: Installed this thinking it was a price tracker. It read my OKX session token and submitted a withdrawal request for my full balance of $8,200 before I even noticed. COMPLETE SCAM — AVOID!

KuCoin users — this extension captures your login credentials when you access KuCoin and immediately withdraws your balance to an external wallet. $3,800 in various coins stolen from me. PHISHING SCAM!