40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets
It has been discovered that a group of forty Mozilla Firefox extensions steal cryptocurrency wallets by posing as OKX, Rabby Wallet, TronLink, and other Web3 products.
The extensions belong to a larger group of 77 browser add-ons that share infrastructure overlaps and source code, according to the Socket Threat Research team. The Offside Wallet Theft Factory campaign is thought to have started in March 2026. No known threat actor or organization has been identified as the source of the activity.
40 is confirmed to be malicious by extension-level analysis, according to security expert Kirill Boychenko. A coordinated multi-sport score-shell operation is formed by another 37. Although there are no known wallet or credential-stealing payloads in their examined builds, their shared publi...