Security researchers have uncovered a campaign involving dozens of malicious Firefox add-ons designed to steal cryptocurrency wallet seed phrases and other browser credentials. The operation, dubbed "Offside Wallet Theft Factory" by researchers at Socket, has been active since at least March 2026.
The campaign leveraged a sophisticated method where extensions initially appeared benign, often requesting minimal permissions, before being remotely activated to perform malicious actions. One identified example is an extension named "0KX WEB3," which mimics the OKX cryptocurrency exchange. Despite claiming to collect "no data," this extension, when opened, silently queried a database hosted on Supabase, a legitimate cloud service.
Attackers could manipulate a switch within this database to control the extension's behavior. While typically displaying a harmless decoy, such as a notepad, the extension could be commanded to present a convincing page prompting users to import their wallet by entering their recovery phrase. Any phrase entered on this page would be immediately transmitted to the attackers. This method allowed the criminals to activate the malicious functionality without needing to push updates through the Firefox Add-ons store.
Out of 77 linked extensions identified in the campaign, 40 were confirmed by security experts to be actively stealing information. The remaining 37 extensions initially presented as VPNs, password generators, or note-taking tools, but secretly ran code that tracked sports scores for NBA, hockey, or football. While these specific extensions were not found to contain active malicious code at the time of discovery, their shared code and infrastructure with the info-stealing add-ons raised concerns.
Researchers noted that several extensions confirmed to steal cryptocurrency wallets had initially started as these sports score shells and were later "updated" to swap their scoreboard functionality for credential-stealing capabilities. This highlights a tactic where seemingly innocuous extensions can be weaponized post-installation.
The use of browser add-ons for cryptocurrency theft is not a new phenomenon. Previous incidents include malicious Chrome extensions stealing passphrases and private keys in 2020, over 100 Chrome extensions stealing Google and Telegram data from 20,000 users, and fake ChatGPT extensions stealing login credentials in April of the current year.
Users are advised to exercise caution when installing browser extensions, even those requesting few permissions, as this does not guarantee safety. It is recommended to only install extensions from well-known, verified publishers and to be wary of any extension that asks for a cryptocurrency wallet recovery phrase on a webpage, as legitimate wallets typically do not require this. Regular review and removal of unrecognized or unneeded extensions are also crucial, as extensions can be updated with malicious code after installation. If a recovery phrase has been entered into a suspicious extension, the associated wallet should be considered compromised, and funds should be immediately transferred to a new, secure wallet.
