Socket's threat research team has documented 40 malicious Firefox extensions impersonating Web3 products, inside a broader set of 77 add-ons that share source code and infrastructure. Researcher Kirill Boychenko describes the remaining 37 as a coordinated operation built around score-shell add-ons.

The campaign is called the Offside Wallet Theft Factory and has been running since March 2026. Mozilla has removed the malicious extensions from its marketplace. No group has claimed responsibility.

What they pretended to be

Counterfeits of OKX, Rabby Wallet, TronLink and other cryptocurrency wallets.

A fake wallet extension is a near-perfect crime. The victim installs it expecting to type a recovery phrase into it, because that is what wallet software legitimately asks for. There is no moment where the request looks out of place.

Four different ways of stealing the same thing

Socket's breakdown is unusually specific, and it shows a group iterating rather than shipping one payload:

  • 15 captured recovery phrases and private keys, exfiltrating through Cloudflare Workers
  • 13 modified legitimate Rabby Wallet builds to steal serialised keyrings before encryption
  • 7 used attacker-controlled Supabase projects to serve phishing or decoy content dynamically
  • 5 captured credentials and clipboard data through hard-coded command-and-control

The thirteen that patched a real Rabby build are the technically sharpest. Taking the keyring before encryption means the software behaves correctly, the wallet works, and the encryption the user is relying on happens after the secret has already left. Nothing looks broken, which is the point.

Note also where the stolen data goes: Cloudflare Workers and Supabase. Both are legitimate developer platforms, which makes the outbound traffic unremarkable — the same reasoning behind DeadLock hosting its leak site on Polygon and Google Sheets being used for command and control.

The part worth learning from

Many of these extensions did not start as malware.

They shipped as sports score utilities and other benign tools, and were repurposed into wallet stealers later — under the same Firefox ID. The listing keeps its history, its install base, its reviews and whatever trust the store's ranking gives it.

That inverts how most people assess an extension. Checking reviews and install counts tells you about the software as it was, not as it is, because an update can replace the code entirely while every trust signal stays put. It is dependency confusion and the Shai-Hulud npm worm moved into the browser: the identity persists, the contents do not.

Boychenko's framing of the economics explains why the effort is worth it — a single successful install can expose a recovery phrase or private key worth far more than repeatedly publishing disposable extensions.

What to do

  • Audit the extensions you already have. This is the action. An extension installed two years ago from a developer you trusted is exactly the profile being exploited.
  • Remove anything you do not actively use. Every installed extension is standing code with page access, whether or not you opened it this year.
  • Never type a recovery phrase into a browser extension you did not install from the wallet vendor's own site. Go to the vendor, follow their link. Do not search the store.
  • Use a hardware wallet for anything that matters. The seed never reaches the browser, which removes this entire class.
  • Treat install counts and reviews as historical. They describe a version that may no longer be the one you are running.

What is not established

  • How many people installed them. Socket has not published install figures.
  • How much was stolen. No loss total has been reported.
  • Who is behind it. No actor named, no claim made.
  • Whether other browsers are affected. The research covers Firefox; the technique is not Firefox-specific.