and
tags. We'll translate each paragraph. We'll also translate the headings. We'll ensure numbers and facts are accurate. We'll use appropriate Chinese terms: "recovery phrases" -> "恢复短语" or "助记词" (common in crypto). "private keys" -> "私钥". "wallet keyrings" -> "钱包密钥环" or "钱包钥匙串". We'll use "密钥环". "Rabby wallet" -> "Rabby钱包" (keep as is). "phishing loaders" -> "钓鱼加载器". "serialized keyrings" -> "序列化的密钥环". "sports-score tools" -> "体育比分工具". "deceptive or suspicious sports-score shells" -> "具有欺骗性或可疑的体育比分外壳". "exfiltration infrastructure" -> "数据外泄基础设施". "attributable transactions" -> "可归因的交易". "campaign loss total" -> "活动损失总额". "automated risk indicators" -> "自动化风险指标". "human review" -> "人工审查". "wallet provider's official site" -> "钱包提供商的官方网站". We'll also translate the closing paragraph.
We need to ensure the translation is natural and not word-by-word. We'll also add a meta description in Chinese. Since the original meta description is empty, we'll create one: "Socket发现40个恶意Firefox插件窃取加密钱包数据。了解攻击方式及应对措施。" or something similar.
We'll produce the JSON. Let's write the translation.
We'll start with the title: "Socket发现40个恶意Firefox插件窃取加密钱包秘密"
Content: We'll translate the article. We'll keep the HTML tags. We'll write:
Socket发现40个恶意Firefox插件窃取加密钱包秘密
? Actually, the original content has an at the beginning? The original content starts with
. We'll see: The original content is: "
. We'll produce JSON. Let's craft the article. Title: ..." That seems like a placeholder. Actually, the original content provided is a full article with headings. Let's look at the original content: It starts with "
. We'll produce JSON. Let's craft the article. Title: ..." That is not the actual content; it's the instruction. The actual content is after that. The user provided the original content as a long string that includes the article text. We need to extract the article. The original content is:
"
. We'll produce JSON. Let's craft the article. Title: "Socket Finds 40 Malicious Firefox Add-ons Stealing Crypto Wallet Secrets" Slug: socket-finds-40-malicious-firefox-add-ons-stealing-crypto-wallet-secrets Subtitle: "The add-ons posed as sports-score tools and wallet apps; Mozilla signed some versions as early as March." Content: Lead: Security researchers at Socket have identified 40 Firefox add-ons with confirmed malicious behavior designed to siphon crypto wallet data. The campaign ran from at least March into August, with Mozilla signing 59 original versions between March 9 and Aug. 3, according to a report released Aug. 19. The affected add-ons targeted recovery phrases, private keys, and wallet keyrings, and anyone who installed them should consider their wallet compromised. Then sections. Section 1: "How the add-ons worked" - describe the four attack vectors. Section 2: "The sports-score disguise" - some add-ons had previously been legitimate sports-score tools, 37 were deceptive shells without confirmed theft. Section 3: "What users should do" - move assets, change passwords, etc. Section 4: "The open questions" - no confirmed victims or loss total. We'll write with human rhythm. Use contractions. Let's draft. We need to ensure no stale numbers. We have exact numbers from facts, that's fine. Now, we must produce JSON. We'll set wordCount to approximate. We'll compute later. Let's write the content. Lead: Security researchers at Socket have identified 40 Firefox add-ons with confirmed malicious behavior designed to steal crypto wallet data. The campaign ran from at least March into August, with Mozilla signing records showing 59 versions between March 9 and Aug. 3. The add-ons captured recovery phrases, private keys, and wallet keyrings — and anyone who used them should treat their wallet as compromised. Then H2: "How the add-ons worked" Then a paragraph: The 40 malicious identities split into four distinct attack paths. Seven were remote-controlled phishing loaders. Fifteen captured recovery phrases, private keys, or wallet secrets directly. Thirteen were modified clones of the Rabby wallet that sent serialized keyrings away before encryption. Five collected credentials and clipboard data. Each path ends with the same outcome: the attacker gets enough to drain a wallet. H2: "The sports-score disguise" - "Some of these add-ons had a previous life. Nine had distributed sports-score tools under the same IDs, and 37 more were deceptive or suspicious sports-score shells without a confirmed theft payload. That's a deliberate cover — a user might install a score app and later see a 'wallet helper' update." H2: "What users should do" - "Socket's advice is blunt: uninstalling the add-on can't revoke a secret that's already been exposed. Affected users should move any remaining assets to a fresh wallet created from a new recovery phrase, change passwords, terminate active sessions, and double-check any copied destination addresses before sending." H2: "What's still unknown" - "Socket documented the theft capability and exfiltration infrastructure but did not identify confirmed victims, attributable transactions, or a campaign loss total. The report also doesn't name the add-ons publicly, leaving users to wonder if they were caught. Mozilla says it uses automated risk indicators and human review to catch malicious wallet add-ons, and advises installing only extensions linked from the wallet provider's official site." End with a concrete next step: "Mozilla hasn't said whether it has pulled the specific add-ons or is still investigating. In the meantime, anyone who used a wallet-related Firefox extension this summer would be wise to treat it as hostile." We need to be careful: we said "didn't explain the add-ons publicly" - but facts don't say that. The facts say "Socket documented ... but did not identify confirmed victims..." It doesn't say whether add-ons are named. We shouldn't invent. We'll say "The report doesn't name confirmed victims or a total loss." That's fine. We also need to mention the 9 that previously distributed sports-score tools under the same IDs. That's in the first fact. We'll incorporate. We need to make sure we don't use "industry experts" etc. We have no quotes. Let's write the article in HTML. I'll count words approximately. We'll target ~600. Let me write. I'll produce the JSON. Meta description: "Socket found 40 Firefox add-ons with malicious behavior targeting crypto wallets. Learn the attack vectors and what to do if you're affected." That's about 150 chars. Let's count. "Socket found 40 Firefox add-ons with malicious behavior targeting crypto wallets. Learn the attack vectors and what to do if you're affected." - count: I'll trust. Focus keyword: "malicious Firefox add-ons crypto wallet" Keywords: ["Firefox add-ons", "crypto
