Socket found 40 malicious Firefox extensions posing as Web3 products to drain recovery phrases and private keys.