Malicious Firefox Add-ons Stole Crypto Wallet Seed Phrases and Browser Credentials

Researchers uncovered a long-running Firefox extension campaign, dubbed Offside Wallet Theft Factory, that used dozens of linked add-ons to steal cryptocurrency wallet seed phrases and browser credentials. The operation had been active since at least March 2026 and involved 77 related extensions, with 40 confirmed as malicious. The add-ons impersonated legitimate Web3 and wallet tools, targeting users seeking browser-based cryptocurrency functionality.

One extension highlighted by researchers, 0KX WEB3, presented itself as a crypto wallet but lacked real wallet features. Instead, it queried a Supabase-hosted database that allowed the operators to remotely change the extension from a benign-looking decoy into a phishing interface designed to capture wallet import secrets and passwords. The findings show that even extensions requesting limited permissions can still be weaponized, and that clusters of seemingly harmless add-ons sharing code or infrastructure may later be updated into credential- and wallet-stealing malware.