Wu Shuo learned that 23pds, the Chief Information Security Officer of SlowMist, tweeted that security company Koi has revealed over 40 counterfeit encrypted wallet extensions in the official Firefox browser plugin store, including mainstream wallets such as MetaMask and Coinbase Wallet. These malicious plugins steal mnemonic words by implanting event monitoring code and transmit the data back to the attacker's server.