Security company Socket has discovered a batch of malicious cryptocurrency wallet extensions targeting Firefox users, linking them to an attack campaign named "Offside Wallet Theft Factory." A total of 77 extension identities have been associated, with 40 confirmed to exhibit malicious behavior. The activity has been ongoing from at least March 2026 to August.

These extensions primarily disguise themselves as well-known Web3 wallets such as OKX, Rabby Wallet, and TronLink, using highly realistic wallet interfaces to lure users into importing existing wallets and stealing their mnemonic phrases or private keys. About half of the extensions directly request users to input their mnemonic phrases, while 13 modified versions of Rabby send wallet account information to external servers when users save their data. Additionally, 5 extensions collect saved credentials and clipboard content.

Socket also found that at least 9 malicious extensions previously operated under the guise of sports score applications for football, basketball, and the NBA, accumulating users and reviews before updating to wallet theft code. Furthermore, 37 extensions masquerade as password generators, VPNs, and currency converters, while actually running sports score programs.

Socket warns that if users have entered their mnemonic phrases or private keys in the related extensions, they should consider their wallet credentials permanently compromised. Simply uninstalling the extensions will not revoke the already leaked mnemonic phrases or private keys, and users should immediately transfer their assets to a new wallet.

From a market mechanism perspective, malicious extensions accumulate trust by disguising themselves as well-known wallets and sports applications before stealing private keys, with funds flowing from victim users' wallets to attacker-controlled addresses. Event-driven risks are increasing the demand for security audits and official wallet usage, benefiting legitimate security companies and native wallet developers, while putting pressure on Web3 users relying on browser extensions.

Source: Public Information