Security researchers at Socket have uncovered a large-scale campaign of malicious Firefox extensions designed to steal cryptocurrency assets. The campaign, dubbed Offside Wallet Theft Factory, has been active since at least March 2026. Researchers identified 77 related extensions sharing similar code and infrastructure, 40 of which contained malicious functionality for stealing sensitive data.
Scale of the threat: The malicious add-ons impersonated popular Web3 products, including OKX, Rabby Wallet, TronLink and other crypto wallets. A single successful installation can expose a seed phrase or private key, potentially earning attackers far more than the cost of repeatedly publishing disposable extensions.
Researchers classified the 40 malicious extensions into four groups based on their attack mechanisms:
Seven extensions connected to attacker-controlled Supabase projects and could be instructed remotely to display phishing pages or fake cryptocurrency wallet interfaces. This setup allows attackers to dynamically change their targets without having to update the extension itself.
Fifteen add-ons stole seed phrases, private keys and other cryptocurrency wallet secrets and transmitted them to operators through Cloudflare Workers. Using serverless infrastructure makes command-and-control servers more difficult to trace and block.
Another 13 extensions were modified versions of Rabby Wallet. All of them stole serialized keyring data before it was encrypted locally. This is especially dangerous because the attack occurs at the stage when sensitive information has not yet been protected by the wallet's cryptography.
The remaining five extensions intercepted credentials and clipboard contents, sending the information to hardcoded command-and-control addresses. This technique is particularly effective against users who copy private keys, seed phrases or other sensitive wallet information.
The campaign used sophisticated disguise techniques. Some extensions initially entered Mozilla's official Firefox add-on directory while posing as harmless sports services or useful browser utilities, only to later transform into credential stealers under the same Firefox ID.
Evolution of the threat: Researchers found nine add-ons whose earlier versions genuinely displayed football, basketball and American football scores. After building a user base, their functionality was changed to malicious behavior.
Researchers separately examined 37 extensions disguised as sports score trackers for the NBA, football, hockey and other competitions. All of them contained the same hardcoded key for the legitimate API-Sports service, while presenting users with completely different functionality:
Using the legitimate API-Sports service allowed the extensions to appear harmless during superficial inspection while malicious logic operated in parallel.
The attackers relied on two primary methods for stealing sensitive information:
The extension functioned as a loader that remotely fetched fake cryptocurrency wallet pages. Users entered their information into a phishing interface without realizing that it was unrelated to the legitimate wallet. For attackers, this approach offers several advantages: targets can be changed quickly, and static analysis of the extension's packaged code is less likely to reveal the full malicious functionality.
In other cases, the malicious code was embedded directly inside the browser extension and intercepted sensitive information at the browser level. This method can be harder to detect because it does not require additional network requests to download a separate payload.
The campaign operators use a sophisticated distribution strategy:
Attack economics: The republishing model is cheap and highly scalable. Just one successful extension installation can generate more money for attackers than the cost of continuously publishing disposable add-ons.
Socket recommends several layers of protection:
If you suspect that you may have installed a malicious extension, warning signs can include:
Emergency response: If you suspect compromise, immediately remove recently installed extensions, change passwords, inspect your crypto wallets for suspicious activity and move funds to a new wallet generated from a new seed phrase.
The Offside Wallet Theft Factory campaign reflects a broader trend toward increasingly sophisticated attacks delivered through browser extensions:
Firefox remains popular among cryptocurrency users because of:
That combination makes Firefox users an attractive target for campaigns specifically designed to steal cryptocurrency assets.
Given the scale of the campaign, users should consider the following steps:
The Offside Wallet Theft Factory campaign demonstrates that browser extensions remain a serious attack vector for cryptocurrency users. The combination of social engineering through impersonation of legitimate services, technical sophistication through distributed malicious logic, and an economically efficient republishing model makes these threats particularly dangerous.
For cryptocurrency users, the main lesson is simple: security requires constant vigilance. Regularly auditing browser extensions, using hardware wallets for significant holdings and never entering seed phrases into suspicious browser add-ons can protect users from the majority of these attacks.
Fundamental principle: In cryptocurrency, you are ultimately responsible for your own security. No antivirus product or built-in browser protection can replace careful judgment when installing extensions or entering sensitive information.
The industry continues to develop tools for defending against these threats, including automated extension code analysis, reputation-based systems and community-driven blocklists. But the final layer of protection still depends on the user. Stay cautious, verify extensions before installation and never entrust your crypto assets to questionable browser add-ons.
Offside Wallet Theft Factory is neither the first nor the last malicious extension campaign. However, understanding how these attacks work and following basic security practices can dramatically reduce the risk of becoming a victim. In an environment where a single extension can cost you your entire crypto portfolio, vigilance is not paranoia — it is a necessity.
“Security is not a product you can buy once, but a process that must be maintained continuously. In the digital age, the weakest link is often not the technology, but the human factor.”
— Bruce Schneier, cryptographer and security expert
