Loading story…
Researchers uncovered a long-running Firefox extension campaign, dubbed Offside Wallet Theft Factory, that used dozens of linked add-ons to steal cryptocurrency wallet seed phrases and browser credentials. The operation had been active since at least March 2026 and involved 77 related extensions, with 40 confirmed as malicious. The add-ons impersonated legitimate Web3 and wallet tools, targeting users seeking browser-based cryptocurrency functionality.
One extension highlighted by researchers, 0KX WEB3, presented itself as a crypto wallet but lacked real wallet features. Instead, it queried a Supabase-hosted database that allowed the operators to remotely change the extension from a benign-looking decoy into a phishing interface designed to capture wallet import secrets and passwords. The findings show that even extensions requesting limited permissions can still be weaponized, and that clusters of seemingly harmless add-ons sharing code or infrastructure may later be updated into credential- and wallet-stealing malware.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Socket researchers said the linked malicious Firefox add-on campaign they dubbed the "Offside Wallet Theft Factory" has been operating since at least March 2026. The campaign used Firefox extensions tied together by shared code and infrastructure.
Socket reported that 13 extensions used modified Rabby wallet code to exfiltrate serialized keyring data before local encryption, while 15 displayed counterfeit wallet-import forms that sent recovery phrases and private keys to Cloudflare Workers. A separate cluster of five extensions stole credentials and clipboard contents and transmitted the data over plain HTTP to a hardcoded command-and-control server.
Offside Wallet Theft Factory operators published seemingly benign sports-score services and utilities in the official Firefox add-on catalog, then later updated some under the same Firefox IDs into credential and cryptocurrency-wallet stealers. Researchers identified nine add-ons whose earlier versions provided real football, basketball, or American-football scores before becoming malicious.
Researchers described a malicious Firefox extension named "0KX WEB3" that impersonated a crypto wallet but contained no real wallet functionality. Instead, it queried a Supabase-hosted database that allowed attackers to remotely switch it from a harmless decoy into a wallet-import phishing interface that captured seed phrases.
Researchers identified 77 related Firefox extensions associated with the campaign, with 40 confirmed to steal cryptocurrency wallet seed phrases or password details. The remaining 37 posed as benign tools such as VPNs, password generators, or note-taking apps while sharing the same infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcesecurityonline.info
Open sourcebitdefender.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered a campaign dubbed **Offside Wallet Theft Factory** that used at least **40 malicious Firefox extensions** impersonating Web3 products including **OKX**, **Rabby Wallet**, and **TronLink** to steal cryptocurrency wallet data. The operation is tied to a broader cluster of **77 browser add-ons** sharing source code and infrastructure, and is believed to have been active since **March 2026**. Investigators said some of the add-ons were initially published on the official Firefox marketplace as benign sports-score or utility extensions before being repurposed under the same Firefox IDs into wallet-stealing malware. The extensions used several theft methods, including fake wallet pages and phishing redirects, embedded logic to capture **seed phrases**, serialized keyrings, credentials, and clipboard contents, and exfiltration through **Cloudflare Workers** and attacker-controlled **Supabase** projects that also acted as remote switches. Reporting also identified recurring code markers and infrastructure overlap across the packages, including shared request tokens, hard-coded command-and-control elements, custom hook endpoints, a dedicated IP address, and a phishing page on `pages.dev` delivered by a fake **0KX WEB3** extension. The activity has not been attributed to a known threat actor.
Aug 21, 2026
Researchers uncovered the **Superior** campaign, in which attackers distributed 18 malicious Chrome extensions and one Microsoft Edge extension that stole cryptocurrency-wallet secrets, credentials, browser data, and social-media sessions. The operator reportedly acquired legitimate extensions—or first published benign versions—then used automatic extension updates to install a modular malware framework after building an install base; the activity may have begun in early 2024. The extensions used encrypted persistent WebSocket connections for command-and-control, received rotatable infrastructure endpoints, removed page Content Security Policy headers, and injected malicious scripts into sites victims visited. Modules supported wallet draining, seed-phrase phishing, exchange-session theft, form and credential capture, browser-history collection, and ClickFix-style fake-update lures. Google removed the identified Chrome extensions, but an affected Edge extension remained available at reporting time; users should remove affected extensions, change passwords, revoke active sessions, and move cryptocurrency to newly created wallets.
Sep 4, 2026
Researchers uncovered multiple browser-extension campaigns that abused clipboard access to steal sensitive data and cryptocurrency. Socket found that Chrome and Firefox extensions branded as **VPN Go: Free VPN** initially behaved like legitimate proxy tools before later updates added clipboard monitoring, data chunking, session tagging, and HTTP exfiltration to hardcoded attacker-controlled IP addresses. The Chrome extension turned malicious in version `1.1`, while the Firefox add-on first did so in version `1.3.3`, indicating a staged update strategy designed to retain users while covert theft ran in parallel. A separate campaign tracked as **Silent Swap** used unsigned installers to deploy a fake **Google Notes** Chromium extension that replaced copied wallet addresses with attacker-controlled ones, enabling cryptocurrency theft across multiple coins. McAfee said the malware modified Chromium preference files and recalculated integrity values to avoid detection, while using **EtherHiding** and blockchain-based dead-drop resolution to fetch command-and-control details; the activity also overlaps with **CountLoader**, suggesting a shared operator. Google and Mozilla were notified about the malicious VPN-themed extensions, and users who copied passwords, wallet addresses, or other secrets while the add-ons were installed are advised to treat that data as compromised.
Jun 30, 2026