40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets
Summary: Socket Threat Research found 40 malicious Mozilla Firefox extensions posing as OKX, Rabby Wallet, TronLink and other Web3 products, part of a broader set of 77 add-ons sharing source code and infrastructure, in a campaign dubbed Offside Wallet Theft Factory believed active since March 2026. Of the 40, 15 capture recovery phrases and private keys and exfiltrate them through Cloudflare Workers, 13 are modified Rabby Wallet builds that exfiltrate serialized keyrings before local encryption, seven use attacker-controlled Supabase projects as remote switches to serve phishing or decoy content, and five capture credentials and clipboard data through hard-coded command and control infrastructure.
What you should know: Some of these extensions first appeared on the official Firefox marketplace as sports score or utility shells and were later repurposed into wallet stealers under the same Firefox ID, so an add-on that looked benign at install time can turn hostile without a new install. As researcher Kirill Boychenko put it, a single successful installation can expose a recovery phrase or private key worth far more than the cost of repeatedly publishing disposable extensions.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026