Odaily Planet Daily reported that 23pds, a partner and Chief Information Security Officer of Slow Fog, issued a warning on platform X. The security company Koi disclosed that over 40 counterfeit cryptocurrency wallet extensions have appeared in the official Firefox browser extension store, imitating mainstream wallets such as MetaMask and Coinbase Wallet. These malicious plugins steal mnemonic phrases by embedding event listener code and send the data back to the attacker's server.