Malware

Offside Wallet Theft Factory

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

In some cases, the add-ons first appeared on the official Firefox extensions marketplace as sports score or utility shells, before they were turned into wallet-stealing malware under the same Firefox ID.

T1566PhishingEvidence2

The wallet secrets are stolen using two methods: either remotely loading a fake wallet page or baking the functionality into the extension itself.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

седум користат Supabase проекти контролирани од напаѓачите како далечински прекинувачи за динамичко пренасочување

Persistence

2 techniques

T1176Software ExtensionsEvidence1

The delivery vector is malicious Firefox Add-ons impersonating wallets and disguised utilities, distributed through the Firefox Add-ons store.

T1556Modify Authentication ProcessEvidence1

13 модифицирани верзии на Rabby Wallet ги крадат сериски запишаните keyring податоци пред нивното локално шифрирање

Stealth

2 techniques

T1036MasqueradingEvidence2

A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, TronLink, and other Web3 products.

T1036.005Match Legitimate Resource Name or LocationEvidence1

Many pose as crypto wallets, copying real branding and screenshots. Others hide as themes, VPNs, or note-taking tools.

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

13 модифицирани верзии на Rabby Wallet ги крадат сериски запишаните keyring податоци пред нивното локално шифрирање

Credential Access

4 techniques

T1056Input CaptureEvidence2

Among those 40 extensions, seven use threat actor-controlled Supabase projects as remote switches to server phishing or decoy content dynamically; 15 capture recovery phrases, private keys, and other wallet secrets, and exfiltrate them through Cloudflare Workers; 13 modified Rabby Wallet builds exfiltrate serialized keyrings before local encryption; and the remaining five capture credentials and clipboard data through hard-coded command and control (C2) infrastructure.

T1056.003Web Portal CaptureEvidence1

The fake page then asks victims to import a wallet using a recovery phrase. Submitted recovery phrases and keys go to attacker-run Cloudflare Worker deployments.

T1552.004Private KeysEvidence1

Thirteen extensions exfiltrate serialized keyring data before local encryption runs. The theft hooks a normal save routine, so the wallet still works.

T1556Modify Authentication ProcessEvidence1

13 модифицирани верзии на Rabby Wallet ги крадат сериски запишаните keyring податоци пред нивното локално шифрирање

Collection

3 techniques

T1056Input CaptureEvidence2

T1056.003Web Portal CaptureEvidence1

The fake page then asks victims to import a wallet using a recovery phrase. Submitted recovery phrases and keys go to attacker-run Cloudflare Worker deployments.

T1115Clipboard DataEvidence3

A separate cluster of five extensions steals credentials and clipboard contents. The clipboard capture is split into numbered chunks so the server can rebuild large content.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

That data flows to a hardcoded command-and-control server over plain HTTP.

T1102Web ServiceEvidence1

These loaders pull a URL from a threat actor-controlled Supabase project. A single value flips the extension between a decoy and a live phishing page.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence3

Cloudflare Workers receive stolen recovery phrases and keys.

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

6 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

security online infoNews

Aug 26, 2026

77 Malicious Firefox Extensions Steal Crypto Wallets

A campaign of malicious Firefox add-ons impersonating cryptocurrency wallets or disguised as utilities. Variants steal wallet recovery phrases, private keys, serialized keyring data, credentials, and clipboard contents; they use Supabase for remotely controlled phishing content, Cloudflare Workers for exfiltration, and in some cases a hardcoded HTTP C2 server.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Offside Wallet Theft Factory

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

T1566PhishingEvidence2

The wallet secrets are stolen using two methods: either remotely loading a fake wallet page or baking the functionality into the extension itself.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

Persistence

2 techniques

T1176Software ExtensionsEvidence1

The delivery vector is malicious Firefox Add-ons impersonating wallets and disguised utilities, distributed through the Firefox Add-ons store.

T1556Modify Authentication ProcessEvidence1

13 модифицирани верзии на Rabby Wallet ги крадат сериски запишаните keyring податоци пред нивното локално шифрирање

Stealth

2 techniques

T1036MasqueradingEvidence2

A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, TronLink, and other Web3 products.

T1036.005Match Legitimate Resource Name or LocationEvidence1

Many pose as crypto wallets, copying real branding and screenshots. Others hide as themes, VPNs, or note-taking tools.

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

13 модифицирани верзии на Rabby Wallet ги крадат сериски запишаните keyring податоци пред нивното локално шифрирање

Credential Access

4 techniques

T1056Input CaptureEvidence2

T1056.003Web Portal CaptureEvidence1

The fake page then asks victims to import a wallet using a recovery phrase. Submitted recovery phrases and keys go to attacker-run Cloudflare Worker deployments.

T1552.004Private KeysEvidence1

Thirteen extensions exfiltrate serialized keyring data before local encryption runs. The theft hooks a normal save routine, so the wallet still works.

T1556Modify Authentication ProcessEvidence1

13 модифицирани верзии на Rabby Wallet ги крадат сериски запишаните keyring податоци пред нивното локално шифрирање

Collection

3 techniques

T1056Input CaptureEvidence2

T1056.003Web Portal CaptureEvidence1

The fake page then asks victims to import a wallet using a recovery phrase. Submitted recovery phrases and keys go to attacker-run Cloudflare Worker deployments.

T1115Clipboard DataEvidence3

A separate cluster of five extensions steals credentials and clipboard contents. The clipboard capture is split into numbered chunks so the server can rebuild large content.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

That data flows to a hardcoded command-and-control server over plain HTTP.

T1102Web ServiceEvidence1

These loaders pull a URL from a threat actor-controlled Supabase project. A single value flips the extension between a decoy and a live phishing page.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence3

Cloudflare Workers receive stolen recovery phrases and keys.

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

6 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

security online infoNews

Aug 26, 2026

77 Malicious Firefox Extensions Steal Crypto Wallets

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.