As reported by The Hacker News, the Socket Threat Research team has uncovered a coordinated campaign dubbed Offside Wallet Theft Factory — 40 confirmed malicious Firefox extensions (out of 77 suspicious add-ons) impersonating legitimate Web3 wallet products such as OKX, Rabby Wallet, and TronLink to steal recovery phrases, private keys, and serialized keyrings. The campaign has been active since at least March 2026 and remains unattributed.

Threat Alert: What makes this campaign particularly notable from a defensive standpoint is not the crypto-stealing payload itself — wallet-draining malware is well-trodden ground — but rather the operational sophistication of the delivery mechanism.

What makes this campaign particularly notable from a defensive standpoint is not the crypto-stealing payload itself — wallet-draining malware is well-trodden ground — but rather the operational sophistication of the delivery mechanism. The threat actor leveraged Mozilla's official AMO (Add-ons for Mozilla) marketplace as a distribution channel, lending these extensions an implicit trust signal that many users and even security-conscious organizations rely on.

Why This Matters Beyond Crypto

Several design choices in this campaign should concern defenders even outside the cryptocurrency space:
Why This Matters Beyond Crypto
Bait-and-switch updates: Nine of the malicious extension identities initially published benign sports-score or utility functionality before later versions were repurposed into wallet-stealing malware under the same Firefox ID. This is a marketplace trust model problem — an extension that is safe today can become malicious tomorrow via a routine update.
Dynamic remote switching: Seven extensions use threat actor-controlled Supabase projects as remote configuration switches, enabling them to serve phishing content or decoy pages on demand. This means static analysis of a downloaded extension may not reveal its true capability at any given moment.
Legitimate infrastructure abuse: Exfiltration routes through Cloudflare Workers and a legitimate API-Sports service for credential sharing demonstrate how attackers blend into normal traffic patterns, complicating network-level detection.

The bait-and-switch update pattern is the most dangerous element here. It defeats extension vetting at publication time because the malicious behavior is introduced weeks or months later through a version update — after the extension has accumulated reviews, install count, and user trust.

Who Is Affected

Primary victims are individual cryptocurrency users and DeFi participants who installed these extensions from Mozilla's official marketplace. However, organizations that allow employees to install Firefox extensions without central management — particularly those in fintech, Web3 development, and digital asset management — face indirect risk if compromised extensions access corporate SaaS sessions or internal credentials stored in the browser.

The five extensions with hard-coded C2 infrastructure and clipboard-capture capability are especially concerning in enterprise environments, as clipboard monitoring can intercept passwords, MFA codes, and internal document snippets beyond just wallet seed phrases.

Broader Implications for Browser Extension Security

This campaign exposes a structural weakness in browser extension marketplaces that extends well beyond Firefox. The ability to publish a benign extension, build trust, and then push a malicious update — all within the marketplace's review window — is an attack pattern that applies equally to Chrome Web Store and Edge Add-ons. Security teams that treat browser extensions as a solved problem are operating on outdated assumptions.

The use of homoglyph and Unicode trickery in extension names (e.g., substituting characters in "Rabby Wallet") further demonstrates that visual inspection of extension names is insufficient as a control.

Shield53 Recommendations

  • Audit immediately: Inventory all Firefox extensions across managed endpoints. Compare against the list of 40 confirmed malicious extension IDs published by Socket. Remove any matches and treat affected users as compromised — rotate all credentials and wallet keys accessed through that browser profile.
  • Implement extension allowlisting: Use Firefox Enterprise Policies or mobile device management to restrict extension installation to an approved list. Block AMO access for unmanaged installs where feasible.
  • Monitor for update-based threats: Establish a process to re-evaluate approved extensions after every update. Track version changes and flag extensions that significantly change their permission scope or remote configuration behavior between versions.
  • Network detection: Flag outbound traffic to Supabase projects and Cloudflare Workers endpoints originating from browser extension processes. While these are legitimate services, unexpected extension-to-Serverless-Function traffic warrants investigation.
  • Clipboard monitoring controls: On managed endpoints, consider OS-level clipboard access monitoring to detect extensions or processes reading clipboard data at high frequency.
  • User awareness: Brief users — especially those in finance or crypto-adjacent roles — that an extension's presence in an official marketplace does not guarantee ongoing safety. Emphasize that wallet recovery phrases should never be entered into any browser extension under any circumstances.

The Offside campaign is a proof of concept for a broader attack pattern: marketplace-published, update-weaponized, infrastructure-abusing browser malware. As browser extensions continue to hold privileged access to sessions, credentials, and rendered page content across virtually every SaaS application, they deserve the same governance rigor as installed software on the endpoint.