Firefox Extension Ring Keeps Stealing Wallet Secrets
Socket says 40 of 77 linked Mozilla Firefox extensions are actively stealing crypto wallet secrets, credentials, and clipboard data in a campaign it calls Offside Wallet Theft Factory. The add-ons pose as OKX, Rabby Wallet, TronLink, and other Web3 products, and some were still live into August.
The theft works two ways: some extensions swap in a fake wallet page so victims type recovery phrases or keys into it, while others bake the theft into the add-on itself. Socket also found threat-actor-controlled Supabase projects used as remote switches, which lets the operator keep serving phishing or decoy content and exfiltrate data even when a shell is removed.
The lasting exposure is the publishing model, not one bad listing. If a browser profile trusted these extensions with wallet material, shared code, Firefox IDs, and remote switches mean removal of one add-on may not end the campaign or the identity behind it.