40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets

A set of 40 malicious Mozilla Firefox extensions has been discovered masquerading as popular Web3 products like OKX, Rabby Wallet, and TronLink to steal cryptocurrency wallet secrets. The campaign, dubbed ‘Offside Wallet Theft Factory,’ has been active since March 2026 and was identified by the Socket Threat Research team. The extensions are part of a broader set of 77 browser add-ons sharing source code and infrastructure overlaps.

According to security researcher Kirill Boychenko, 40 extensions are confirmed malicious, while 37 others form a coordinated sports-score shell operation with deceptive functionality but no confirmed wallet-stealing payloads. Among the malicious extensions, seven use threat actor-controlled Supabase projects to dynamically serve phishing or decoy content; 15 capture recovery phrases and private keys, exfiltrating them via Cloudflare Workers; 13 are modified Rabby Wallet builds that exfiltrate serialized keyrings before local encryption; and five capture credentials and clipboard data through hard-coded C2 infrastructure.

The wallet secrets are stolen either by remotely loading a fake wallet page or by baking the functionality directly into the extension. Some add-ons initially appeared on the official Firefox marketplace as sports score or utility shells before being repurposed into wallet-stealing malware under the same Firefox ID. The 37 sports-score extensions share a hard-coded credential for API-Sports, a legitimate sports data service, while marketing unrelated functions like password generation, dark mode, VPN access, and note-taking.

Socket noted that historical versions of nine confirmed malicious identities used sports-score shells before later versions were repurposed. The other 31 malicious identities lack sports API integration but contain confirmed wallet- or credential-stealing functionality. The campaign highlights the economic incentive for threat actors to repeatedly publish disposable extensions, as a single successful installation can expose recovery phrases or private keys worth far more than the cost of publishing.