Threats · 49 days ago
Socket says 40 of 77 linked Mozilla Firefox extensions are actively stealing crypto wallet secrets, credentials, and clipboard data in a campaign it calls Offside Wallet Theft Factory. The add-ons pose as OKX, Rabby Wallet, TronLink, and other Web3 products, and some were still live into August.
The theft works two ways: some extensions swap in a fake wallet page so victims type recovery phrases or keys into it, while others bake the theft into the add-on itself. Socket also found threat-actor-controlled Supabase projects used as remote switches, which lets the operator keep serving phishing or decoy content and exfiltrate data even when a shell is removed.
The lasting exposure is the publishing model, not one bad listing. If a browser profile trusted these extensions with wallet material, shared code, Firefox IDs, and remote switches mean removal of one add-on may not end the campaign or the identity behind it.
3 sources covering this story
Malicious Firefox add-ons caught stealing cryptowallet seed phrases and browser credentials
Every time you add an extension or plugin to your browser, there's a risk that you might be doing more than managing your cryptocurrency wallet, generating passwords, taking notes, or tracking sports results.
40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets
40 malicious Firefox extensions pose as Web3 products to steal recovery phrases, private keys, keyrings, credentials, and clipboard data.
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
Part of the PlainSec briefing for 2026-08-25