. We'll translate the entire content. The original content includes a lead paragraph, then sections with h2 headings. We'll translate all.
We must ensure proper Czech terminology for crypto/tech terms. For example: "crypto wallet" -> "kryptopeněženka" or "peněženka pro kryptoměny". "recovery phrases" -> "obnovovací fráze". "private keys" -> "soukromé klíče". "keyrings" -> "klíčenky" (but in context, "wallet keyrings" might be "klíčenky peněženky" or "klíčové kroužky"? Actually in crypto, "keyring" is a set of keys, often "klíčenka" is used. We'll use "klíčenky". "add-ons" -> "doplňky" or "rozšíření". Firefox add-ons are "doplňky pro Firefox". "malicious" -> "škodlivé". "phishing loaders" -> "phishingové zavaděče" or "phishingové loadery". "serialized keyrings" -> "serializované klíčenky". "exfiltration infrastructure" -> "infrastruktura pro exfiltraci dat". "sports-score tools" -> "nástroje pro sportovní výsledky". "deceptive shells" -> "klamavé obaly" or "podvodné skořápky". "wallet provider's official site" -> "oficiální stránky poskytovatele peněženky". "automated risk indicators" -> "automatizované indikátory rizika". "human review" -> "lidská kontrola". "treat it as hostile" -> "považovat za nepřátelské" or "za kompromitované".
We need to maintain the tone: professional news, with contractions? The original uses contractions like "can't", "doesn't", "hasn't". In Czech, we don't have contractions in the same way, but we can use "nemůže", "nedělá", "nebylo" etc. We'll translate naturally.
We'll produce the JSON with the translated title, content (as HTML string), and meta description. The meta description should be a short summary in Czech, around 150 characters. We'll create: "Socket identifikoval 40 škodlivých doplňků pro Firefox, které kradou data z kryptopeněženek. Zjistěte, jak útočí a co dělat, pokud jste je nainstalovali." That's about 150 chars.
Let's translate the content step by step.
Original lead: "Security researchers at Socket have identified 40 Firefox add-ons with confirmed malicious behavior designed to steal crypto wallet data. The campaign ran from at least March into August, with Mozilla signing records showing 59 versions between March 9 and Aug. 3. The add-ons captured recovery phrases, private keys, and wallet keyrings — and anyone who used them should treat their wallet as compromised."
But the actual content in the prompt is slightly different: It says: "Lead: Security researchers at Socket have identified 40 Firefox add-ons with confirmed malicious behavior designed to siphon crypto wallet data. The campaign ran from at least March into August, with Mozilla signing 59 original versions between March 9 and Aug. 3, according to a report released Aug. 19. The affected add-ons targeted recovery phrases, private keys, and wallet keyrings, and anyone who installed them should consider their wallet compromised." Then we have sections. But the content string provided in the prompt is a bit different: It starts with "
. We'll produce JSON. Let's craft the article. Title: ..." That seems like the instructions are telling us to craft the article. Actually, the "ORIGINAL CONTENT" field contains a long text that includes the article content and also some meta instructions. Let's read carefully.
The user says: "ORIGINAL CONTENT:
. We'll produce JSON. Let's craft the article. Title: "Socket Finds 40 Malicious Firefox Add-ons Stealing Crypto Wallet Secrets" Slug: socket-finds-40-malicious-firefox-add-ons-stealing-crypto-wallet-secrets Subtitle: "The add-ons posed as sports-score tools and wallet apps; Mozilla signed some versions as early as March." Content: Lead: Security researchers at Socket have identified 40 Firefox add-ons with confirmed malicious behavior designed to siphon crypto wallet data. The campaign ran from at least March into August, with Mozilla signing 59 original versions between March 9 and Aug. 3, according to a report released Aug. 19. The affected add-ons targeted recovery phrases, private keys, and wallet keyrings, and anyone who installed them should consider their wallet compromised. Then sections. Section 1: "How the add-ons worked" - describe the four attack vectors. Section 2: "The sports-score disguise" - some add-ons had previously been legitimate sports-score tools, 37 were deceptive shells without confirmed theft. Section 3: "What users should do" - move assets, change passwords, etc. Section 4: "The open questions" - no confirmed victims or loss total. We'll write with human rhythm. Use contractions. Let's draft. We need to ensure no stale numbers. We have exact numbers from facts, that's fine. Now, we must produce JSON. We'll set wordCount to approximate. We'll compute later. Let's write the content. Lead: Security researchers at Socket have identified 40 Firefox add-ons with confirmed malicious behavior designed to steal crypto wallet data. The campaign ran from at least March into August, with Mozilla signing records showing 59 versions between March 9 and Aug. 3. The add-ons captured recovery phrases, private keys, and wallet keyrings — and anyone who used them should treat their wallet as compromised. Then H2: "How the add-ons worked" Then a paragraph: The 40 malicious identities split into four distinct attack paths. Seven were remote-controlled phishing loaders. Fifteen captured recovery phrases, private keys, or wallet secrets directly. Thirteen were modified clones of the Rabby wallet that sent serialized keyrings away before encryption. Five collected credentials and clipboard data. Each path ends with the same outcome: the attacker gets enough to drain a wallet. H2: "The sports-score disguise" - "Some of these add-ons had a previous life. Nine had distributed sports-score tools under the same IDs, and 37 more were deceptive or suspicious sports-score shells without a confirmed theft payload. That's a deliberate cover — a user might install a score app and later see a 'wallet helper' update." H2: "What users should do" - "Socket's advice is blunt: uninstalling the add-on can't revoke a secret that's already been exposed. Affected users should move any remaining assets to a fresh wallet created from a new recovery phrase, change passwords, terminate active sessions, and double-check any copied destination addresses before sending." H2: "What's still unknown" - "Socket documented the theft capability and exfiltration infrastructure but did not identify confirmed victims, attributable transactions, or a campaign loss total. The report also doesn't name the add-ons publicly, leaving users to wonder if they were caught. Mozilla says it uses automated risk indicators and human review to catch malicious wallet add-ons, and advises installing only extensions linked from the wallet provider's official site." End with a concrete next step: "Mozilla hasn't said whether it has pulled the specific add-ons or is still investigating. In the meantime, anyone who used a wallet-related Firefox extension this summer would be wise to treat it as hostile." We need to be careful: we said "didn't explain the add-ons publicly" - but facts don't say that. The facts say "Socket documented ... but did not identify confirmed victims..." It doesn't say whether add-ons are named. We shouldn't invent. We'll say "The report doesn't name confirmed victims or a total loss." That's fine. We also need to mention the 9 that previously distributed sports-score tools under the same IDs. That's in the first fact. We'll incorporate. We need to make sure we don't use "industry experts" etc. We have no quotes. Let's write the article in HTML. I'll count words approximately. We'll target ~600. Let me. I
