A campaign dubbed 'Offside Wallet Theft Factory' involves 40 malicious Firefox extensions that masquerade as Web3 products to steal cryptocurrency wallet secrets. Active since March 2026, the campaign uses deceptive sports-score shells and remote infrastructure to evade detection.