Dozens of Fake Firefox Wallet Extensions Linked to Crypto-Stealing Malware
Forty are confirmed malicious, impersonating OKX, Rabby and TronLink to harvest recovery phrases from anyone who types one in.
We haven't written up this one. Decrypt has the full story — the link below goes straight to it.