Loading story…
Socket Threat Research identified 16 malicious Firefox extensions impersonating Rabby Wallet, OKX Wallet, and browser utilities to harvest cryptocurrency recovery phrases and private keys. Four contained modified Rabby applications, while 12 used OKX-derived phishing interfaces. Functioning variants attempted to send raw wallet secrets to attacker-controlled Cloudflare Workers endpoints, despite every extension manifest declaring no data collection. One compact variant could not execute its theft workflow because of packaging and message-handler defects. Mozilla had unpublished the extensions by October 5, 2026.
Shared code, infrastructure, and the campaign marker EQOx7EIPZSNi led Socket to link the operation with high confidence to a campaign it reported in August 2026. The activity involved malicious wallet impersonation, not a vulnerability in legitimate wallet services. Users who entered recovery phrases or private keys into a functioning variant should treat the affected wallets as compromised, remove the extensions, create replacement wallets in a clean environment, and transfer their assets; removing the extension alone does not invalidate stolen secrets.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Socket published its findings on October 7, 2026, detailing raw-secret exfiltration, malicious extension identifiers, code hashes, and collection endpoints. It assessed with high confidence that the activity continued the August operation and advised exposed users to create new wallets on clean devices and transfer their assets.
Mozilla had unpublished the 16 malicious Firefox extensions by October 5, 2026. Their removal did not invalidate any recovery phrases or private keys already stolen.
Socket identified a cryptocurrency wallet-theft operation in August 2026. Researchers later linked the newly discovered extensions to that operation through reused infrastructure, tactics, wallet lures, and the campaign marker EQOx7EIPZSNi.
Attackers distributed four modified Rabby Wallet clones and twelve OKX-style extensions designed to collect recovery phrases or private keys and transmit them to attacker-controlled Cloudflare Workers. One OKX-style package contained theft code but could not execute it through its normal packaged workflow.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 45 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered a campaign dubbed **Offside Wallet Theft Factory** that used at least **40 malicious Firefox extensions** impersonating Web3 products including **OKX**, **Rabby Wallet**, and **TronLink** to steal cryptocurrency wallet data. The operation is tied to a broader cluster of **77 browser add-ons** sharing source code and infrastructure, and is believed to have been active since **March 2026**. Investigators said some of the add-ons were initially published on the official Firefox marketplace as benign sports-score or utility extensions before being repurposed under the same Firefox IDs into wallet-stealing malware. The extensions used several theft methods, including fake wallet pages and phishing redirects, embedded logic to capture **seed phrases**, serialized keyrings, credentials, and clipboard contents, and exfiltration through **Cloudflare Workers** and attacker-controlled **Supabase** projects that also acted as remote switches. Reporting also identified recurring code markers and infrastructure overlap across the packages, including shared request tokens, hard-coded command-and-control elements, custom hook endpoints, a dedicated IP address, and a phishing page on `pages.dev` delivered by a fake **0KX WEB3** extension. The activity has not been attributed to a known threat actor.
Aug 21, 2026
Researchers uncovered a long-running Firefox extension campaign, dubbed **Offside Wallet Theft Factory**, that used dozens of linked add-ons to steal cryptocurrency wallet seed phrases and browser credentials. The operation had been active since at least March 2026 and involved **77 related extensions**, with **40 confirmed as malicious**. The add-ons impersonated legitimate Web3 and wallet tools, targeting users seeking browser-based cryptocurrency functionality. One extension highlighted by researchers, **`0KX WEB3`**, presented itself as a crypto wallet but lacked real wallet features. Instead, it queried a **Supabase-hosted database** that allowed the operators to remotely change the extension from a benign-looking decoy into a phishing interface designed to capture wallet import secrets and passwords. The findings show that even extensions requesting limited permissions can still be weaponized, and that clusters of seemingly harmless add-ons sharing code or infrastructure may later be updated into credential- and wallet-stealing malware.
Aug 27, 2026
Researchers uncovered the **Superior** campaign, in which attackers distributed 18 malicious Chrome extensions and one Microsoft Edge extension that stole cryptocurrency-wallet secrets, credentials, browser data, and social-media sessions. The operator reportedly acquired legitimate extensions—or first published benign versions—then used automatic extension updates to install a modular malware framework after building an install base; the activity may have begun in early 2024. The extensions used encrypted persistent WebSocket connections for command-and-control, received rotatable infrastructure endpoints, removed page Content Security Policy headers, and injected malicious scripts into sites victims visited. Modules supported wallet draining, seed-phrase phishing, exchange-session theft, form and credential capture, browser-history collection, and ClickFix-style fake-update lures. Google removed the identified Chrome extensions, but an affected Edge extension remained available at reporting time; users should remove affected extensions, change passwords, revoke active sessions, and move cryptocurrency to newly created wallets.
Sep 4, 2026