{"id":2480,"date":"2026-08-21T02:07:02","date_gmt":"2026-08-21T02:07:02","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2480"},"modified":"2026-08-21T02:07:02","modified_gmt":"2026-08-21T02:07:02","slug":"40-malicious-firefox-extensions-pose-as-web3-products-to-steal-wallet-secrets","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2480","title":{"rendered":"40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 20, 2026<\/span><\/span>Browser Security \/ Cryptocurrency<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, TronLink, and other Web3 products.<\/p>\n

According to the Socket Threat Research team, the extensions are part of a broader set of 77 browser add-ons that share source code and infrastructure overlaps. The campaign, dubbed Offside Wallet Theft Factory<\/strong>, is believed to have been active since March 2026. The activity has not been attributed to any known threat actor or group.<\/p>\n

\u00abExtension-level analysis confirms 40 as malicious,\u00bb security researcher Kirill Boychenko said<\/a>. \u00abAnother 37 form a coordinated multi-sport score-shell operation. Their analyzed builds contain no confirmed credential- or wallet-stealing payloads, but their deceptive functionality, shared publishing artifacts, and version histories indicate malicious intent.\u00bb<\/p>\n

Among those 40 extensions, seven use threat actor-controlled Supabase projects as remote switches to server phishing or decoy content dynamically; 15 capture recovery phrases, private keys, and other wallet secrets, and exfiltrate them through Cloudflare Workers; 13 modified Rabby Wallet builds exfiltrate serialized keyrings before local encryption; and the remaining five capture credentials and clipboard data through hard-coded command and control (C2) infrastructure.<\/p>\n

The wallet secrets are stolen using two methods: either remotely loading a fake wallet page or baking the functionality into the extension itself. In some cases, the add-ons first appeared on the official Firefox extensions marketplace as sports score or utility shells, before they were turned into wallet-stealing malware under the same Firefox ID. <\/p>\n

The 37 extensions related to the sports score operation contain deceptive implementations spanning football, basketball, NBA, and hockey, and share a hard-coded credential for legitimate API-Sports<\/a>, a legitimate service that delivers real-time sports data, while marketing unrelated functions such as password generation, dark mode, VPN access, currency conversion, screenshot capture, and note-taking.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abHistorical versions of nine confirmed malicious identities also used sports-score shells spanning football, basketball, NBA, and American football before later versions under the same Firefox IDs were repurposed into wallet-stealing extensions,\u00bb Socket said.<\/p>\n

\u00abThe other 31 confirmed malicious identities lack the sports API integration but contain confirmed malicious wallet- or credential-stealing functionality.\u00bb<\/p>\n

The names of some of the malicious extensions are below –<\/p>\n

    \n
  • Safe-Themes – Browser Extension (bliss-heaven@webbrol.com)<\/li>\n
  • Rabbit For Desktop (bright-save-feed@tabtools.org)<\/li>\n
  • \u211eab\u2422y Wa\u2758Iet (flex-clock-dash@extrakits.com)<\/li>\n
  • Rabb-Wal\u04cfet CryptoPortfolio (free-note-bolt@webtools.co)<\/li>\n
  • RABB-Wal\u04cfet Web3 & EVM (safe-stat-pure@proaddons.net)<\/li>\n
  • Rabbit\/WALLET – EVM (sharp-stat-gear@netplugs.net)<\/li>\n<\/ul>\n

    \u00abA single successful installation can expose a recovery phrase, private key, or wallet state worth far more than the cost of repeatedly publishing disposable extensions,\u00bb Boychenko said.<\/p>\n

    \u00abThat economics helps explain the threat actors\u2019 persistence in targeting the Firefox Add-ons ecosystem even when individual extensions are short-lived and ultimately removed. Rotating names and IDs, repurposing existing extension identities, cloning code, and separating malicious functionality across extensions, remote pages, and cloud infrastructure make repeated publication cheap and scalable.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    \ue804Ravie Lakshmanan\ue802Aug 20, 2026Browser Security \/ Cryptocurrency A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, TronLink,…<\/p>\n","protected":false},"author":1,"featured_media":2481,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[361,510,33,2150,3119,145,571,1049,3118],"class_list":["post-2480","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-extensions","tag-firefox","tag-malicious","tag-pose","tag-products","tag-secrets","tag-steal","tag-wallet","tag-web3"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2480","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2480"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2480\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2481"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2480"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2480"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2480"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}