77 Firefox Extensions Linked to Crypto Wallet and Credential Theft

Socket researchers identified a network of 77 linked Firefox extensions active from at least March through August 2026, provisionally named the “Offside Wallet Theft Factory,” with 40 confirmed to steal cryptocurrency wallet secrets, credentials, or clipboard data and 37 deceptive extensions functioning as mislabeled sports-score applications. The confirmed malware impersonated products including OKX, Rabby Wallet, and TronLink, using remotely controlled Supabase loaders to deliver phishing pages, embedded Cloudflare Worker endpoints to collect recovery phrases and private keys, modified Rabby code to exfiltrate wallet keyrings before encryption, and hardcoded infrastructure to capture credentials and clipboard contents. Shared code, infrastructure, naming patterns, signing activity, and version histories linked many extensions, including identities that began as sports-score shells or benign-looking utilities before later updates transformed them into wallet-stealing tools. Although the 37 analyzed sports shells contained no confirmed theft payloads, their misleading descriptions, shared development artifacts, and direct historical connections to later malware suggested they may have served as staging builds within the operation. Mozilla was notified of extensions that remained available, while the report emphasizes that low permission requests do not ensure safety and that exposed wallet recovery phrases or private keys should be considered permanently compromised.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.