Security Company Socket Discovers Malicious Wallet Extension Activity Targeting Firefox
Security company Socket has discovered a batch of malicious cryptocurrency wallet extensions targeting Firefox users, linking them to an attack campaign named "Offside Wallet Theft Factory." A total of 77 extension identities have been associated, with 40 confirmed to exhibit malicious behavior. The activity has been ongoing from at least March 2026 to August.
These extensions primarily disguise themselves as well-known Web3 wallets such as OKX, Rabby Wallet, and TronLink, using highly realistic wallet interfaces to lure users into importing existing wallets and stealing their mnemonic phrases or private keys. About half of the extensions directly request users to input their mnemonic phrases, while 13 modified versions of Rabby send wallet account information to external servers when users save their data. Additionally, 5 extensions collect saved credentials and clipboard content.
Socket also found that at least 9 malicious extensions previously operated under the guise of sports score applications for football, basketball, and the NBA, accumulating users and reviews before updating to wallet theft code. Furthermore, 37 extensions masquerade as password generators, VPNs, and currency converters, while actually running sports score programs.
Socket warns that if users have entered their mnemonic phrases or private keys in the related extensions, they should consider their wallet credentials permanently compromised. Simply uninstalling the extensions will not revoke the already leaked mnemonic phrases or private keys, and users should immediately transfer their assets to a new wallet.
From a market mechanism perspective, malicious extensions accumulate trust by disguising themselves as well-known wallets and sports applications before stealing private keys, with funds flowing from victim users' wallets to attacker-controlled addresses. Event-driven risks are increasing the demand for security audits and official wallet usage, benefiting legitimate security companies and native wallet developers, while putting pressure on Web3 users relying on browser extensions.
Source: Public Information
ABAB AI Insight
Socket has previously focused on open-source and browser extension security scanning. This time, linking 77 identities to the same attack factory model continues its path of supply chain attacks through code reuse and version history tracking, similar to earlier discoveries of malicious npm packages and Chrome extension hijacking cases.
In terms of capital pathways, attackers first accumulate users and reviews through sports score and utility extensions, then update them to wallet theft code. Their motivation is to obtain private keys at low cost and directly transfer assets, with resources delivered to multiple extension identities through shared infrastructure and remote loaders, forming a pipeline from bait to monetization.
Comparing to the large-scale private key theft activities of Chrome extensions in the 2020s and the counterfeit wave warned by official wallets like Phantom, the current attack is transitioning from single extensions to factory-style mass production, with the industry position shifting from opportunistic phishing to systemic supply chain contamination.
The structural judgment belongs to technological substitution, with the mechanism allowing browser extension updates to instantly replace harmless shells with malicious payloads, lowering detection thresholds. Attackers can scale code and infrastructure reuse, leading to a systematic erosion of user trust in third-party extensions.
ABAB News · Cognitive Laws
Extension updates can instantly turn tools into thieves
Accumulating reviews as a shell is the cheapest ticket for attacks
Once a private key is entered, it is permanently irreversible