Mozilla begins screening Firefox extensions for crypto scams

Even though the crypto mining boom has largely passed, cryptocurrency scams still remain out there. Since crypto wallets often come in the form of a web browser extension, so do crypto scams—and Mozilla has spotted hundreds of them trying to get onto the official repository of Firefox extensions. Now, a new tool that automatically scans for them exists. So sayeth a new Mozilla blog post, spotted by BleepingComputer. Exactly how the automated system determines that a newly-posted extension is suspicious isn’t elucidated… but I suppose spelling it out would just give scammers an easy way to circumvent it. If the system spots enough red flags, it holds the extension for human review, after which the extension can be approved or tossed out. At the moment, the system is only applied to “wallet” Firefox extensions, though I have to assume there are other systems in place for more general threats. Firefox is one of the last major browsers that still isn’t based on the open-source Chromium, the root project for Google Chrome and Microsoft’s Edge, so extension developers already have to target it narrowly. Of course, this system only protects users who are going through Mozilla’s official repository of Firefox extensions at addons.mozilla.org. Hackers and scammers can—and often do—entice unwary users to download extensions from third-party sites. Downloading from official sources (like the Chrome Web Store for Chromium-based browsers) doesn’t automatically protect you, but it’s generally a safer bet than downloading and installing extensions from elsewhere.

Jun 4, 2025 - 22:20

Even though the crypto mining boom has largely passed, cryptocurrency scams still remain out there. Since crypto wallets often come in the form of a web browser extension, so do crypto scams—and Mozilla has spotted hundreds of them trying to get onto the official repository of Firefox extensions. Now, a new tool that automatically scans for them exists.

So sayeth a new Mozilla blog post, spotted by BleepingComputer. Exactly how the automated system determines that a newly-posted extension is suspicious isn’t elucidated… but I suppose spelling it out would just give scammers an easy way to circumvent it. If the system spots enough red flags, it holds the extension for human review, after which the extension can be approved or tossed out.

At the moment, the system is only applied to “wallet” Firefox extensions, though I have to assume there are other systems in place for more general threats. Firefox is one of the last major browsers that still isn’t based on the open-source Chromium, the root project for Google Chrome and Microsoft’s Edge, so extension developers already have to target it narrowly.

Of course, this system only protects users who are going through Mozilla’s official repository of Firefox extensions at addons.mozilla.org. Hackers and scammers can—and often do—entice unwary users to download extensions from third-party sites. Downloading from official sources (like the Chrome Web Store for Chromium-based browsers) doesn’t automatically protect you, but it’s generally a safer bet than downloading and installing extensions from elsewhere.