Crypto Theft on Firefox: Socket Uncovers 40 Malicious Extensions…

Security firm Socket has identified a campaign dubbed 'Offside Wallet Theft Factory' comprising 77 interconnected Firefox extensions, 40 confirmed as malware designed to steal cryptocurrency wallet recovery phrases and credentials. Mozilla signing records date the campaign's activity from March 9 to August 3, 2026. Editorial sources from August 25, 2026 reported Socket's findings; no direct primary source from the Socket team is available. Some extensions were still active at the time of reporting.

Key Takeaways

Socket linked 77 Firefox extensions through shared code patterns, similar IDs, and common infrastructure: 40 are confirmed malicious, while 37 posed as utility tools but only served sports scores.
Nine confirmed malicious extensions began life as sports score apps — soccer, basketball, NBA, American football — and were converted into wallet malware via updates under the same Firefox ID.
Roughly half the malicious extensions present a convincing wallet interface to harvest recovery phrases or private keys; 13 are modified Rabby Wallet builds that behave normally but exfiltrate account data; 5 steal saved credentials and clipboard contents.
The counterfeit '0KX WEB3' extension — using a zero in place of the 'O' in OKX — requests only two permissions (storage and tabs) because it acts as a remote-controlled phishing vehicle via Supabase, according to CyberNews.

The Trojan Horse of Updates: From Scoreboard to Wallet Drainer

The mechanism that makes this campaign insidious isn't the technical complexity of the payload, but the abuse of the extension store trust model. Extensions gain legitimacy through innocuous functionality — in nine cases, sports score apps — accumulating organic installs. When the operator decides to activate the malicious phase, the code is swapped via update under the same extension identifier, exploiting permissions already granted by the user.

This pivoting renders the main informal security criterion users adopt ineffective: judging an extension by the permissions requested at install time. The permissions were those of a mundane sports app; the malware arrives later, through an update the user has no reason to suspect. The 37 sports 'shell' extensions share a single hardcoded credential for a legitimate sports data provider, according to Decrypt.

The '0KX WEB3' Variant: When Fewer Permissions Mean More Danger

Among the extensions analyzed, '0KX WEB3' represents a case showing how limited permissions don't guarantee harmlessness. Instead of requesting broad browser access, this extension limits itself to storage and tabs — two common permissions. The mechanism triggers via a hardcoded Supabase project, with URL and anonymous API key embedded in the code. The extension queries the remote database's public_notes table and loads returned URLs in a popup.

Socket classifies this behavior as a "remote-controlled phishing delivery extension" rather than a conventional infostealer, according to CyberNews: the payload doesn't reside in the extension itself but is distributed dynamically. The extension impersonates OKX, exploiting a single-character substitution in the name.

"Socket Threat Research uncovered a 77-extension Firefox campaign: 40 steal wallet secrets and credentials. Another 37 posed as unrelated tools but displayed sports scores. Nine began as score apps before later updates turned them into wallet malware." — Socket (reported by Decrypt)

The Campaign by the Numbers

The breakdown of the 40 confirmed malicious extensions — provided by Socket and repeated consistently across editorial sources — shows tactical diversification: roughly twenty present a fake wallet interface for direct recovery phrase collection; 13 are modified Rabby Wallet builds that replicate the original app's legitimate behavior but route account data to external servers; 5 focus on stealing browser-saved credentials and clipboard contents. For the remaining two, sources do not specify the precise technical variant.

The extensions impersonate established Web3 products: beyond OKX, Rabby Wallet and TronLink, with names often exploiting similar or slightly altered characters compared to the original brands. This technique aims to catch users searching for known extensions who don't verify the exact name or publisher.

What to Do Now

Anyone who entered recovery phrases or private keys into Firefox wallet extensions between March and August 2026 should consider them "permanently compromised," per Socket's recommendation reported by Decrypt: "move funds to a new wallet."
Mozilla has removed and blocklisted the fraudulent extensions; users who had them installed should verify they are no longer present in the browser.

Context: 2025 Controls and Their Limits

In 2025, Mozilla introduced a specific security mechanism for the Firefox Add-on Portal. These measures proved insufficient to block the 'Offside Wallet Theft Factory' campaign, active from March to August 2026. The brief does not specify the technical details of this failure.

CyberNews provided historical context on Chrome extensions with analogous issues, but sources do not establish a systematic cross-platform comparison. Socket's campaign shows that the problem of malicious updates isn't limited to a single ecosystem.

"Even short-lived cryptocurrency wallet extensions can cause immediate and irreversible financial harm once victims expose recovery phrases or private keys" — Socket (reported by CyberNews)

Source Limitations and Recommendations

This article relies exclusively on editorial articles from Decrypt, CyberNews, and other secondary sources dated August 25, 2026, all reporting the same Socket research. No direct primary source from Socket is available. Specific technical details — such as the '0KX WEB3' Supabase mechanism — come from CyberNews and are not independently verifiable. The exact number of victims or funds stolen is not reported in any source. Socket has not established a single entity behind all 77 extensions.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references

Get DeafLetter