Key Takeaways
- Security researchers have identified 40 malicious Firefox extensions designed to steal crypto wallet recovery phrases, private keys, and account credentials.
- The extensions are part of a wider cluster of 77 Firefox add-ons linked through shared code, infrastructure and publishing patterns.
- Some malicious extensions first appeared as sports-score or utility apps, later evolving into crypto-stealing tools.
Firefox users are facing a new crypto security threat after researchers uncovered 40 malicious browser extensions capable of stealing wallet recovery phrases, private keys, and login credentials.
Socket’s Threat Research team said the extensions belong to a wider network of 77 Firefox add-ons that share code, infrastructure and publishing patterns. Researchers have provisionally named the operation the “Offside Wallet Theft Factory.”
The campaign has been active since at least March 2026 and has continued into August, according to Socket. Mozilla signing records reviewed by the researchers covered versions published between March 9 and Aug. 3, with activity particularly heavy in April and late July.
Fake Firefox Extensions Target OKX, Rabby and TronLink Users
The malicious add-ons impersonated popular Web3 products, including OKX, Rabby Wallet and TronLink, making them appear similar to legitimate crypto wallet extensions.
Once installed, different extensions used different methods to steal sensitive information.
Socket found that 15 extensions captured recovery phrases, private keys, or other wallet secrets and sent the information through Cloudflare Workers. Another 13 modified versions of Rabby Wallet could extract serialized wallet keyrings before they were encrypted locally.
Five other extensions were designed to collect account credentials and clipboard information through hardcoded command-and-control infrastructure.
Another seven used attacker-controlled Supabase projects as remote switches. That allowed operators to determine when an extension should display malicious phishing content instead of its normal interface.
A victim could therefore install an extension that initially appeared harmless, only to later encounter a convincing wallet-import page requesting a recovery phrase. Once entered, the phrase could be transmitted directly to the attackers.
Some Extensions Started as Sports Apps
One of the more unusual findings involves extensions that did not begin as obvious crypto wallet clones.
Socket identified 37 additional add-ons built around deceptive football, basketball, NBA, and hockey score features. Researchers did not confirm wallet-stealing code in those versions, but linked them to the broader operation through shared development and publishing characteristics.
More concerning, the version history of nine confirmed malicious extensions showed that they had previously operated as sports-score apps before later updates replaced that functionality with wallet-stealing code.
That approach could help an extension establish a publishing history before being repurposed.
Socket said it reported extensions that remained available during its investigation to Mozilla’s security team, which responded to the findings. The researchers warned that even short-lived malicious wallet extensions can cause permanent losses because cryptocurrency transactions cannot simply be reversed once stolen assets are transferred.
For users who entered a seed phrase or private key into one of the suspected extensions, simply uninstalling it may not be enough. If those secrets were exposed, the safest response is to create a new wallet with a new recovery phrase and transfer the remaining assets, and to download wallet extensions only from links provided by the wallet provider itself.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
