40 Malicious Firefox Extensions Disguised as Web3 Products Identified in 'Offside Wallet Theft Factory' Campaign

According to a report by Socket Threat Research, a coordinated campaign of malicious browser extensions has been targeting cryptocurrency users via the Mozilla Firefox add-on store. The researchers uncovered 40 extensions that impersonate well-known Web3 wallet services such as OKX Wallet, Rabby Wallet, and TronLink. These malicious add-ons were engineered to blend in with legitimate interfaces, prompting users to input sensitive wallet recovery phrases or private keys under the guise of routine operations.

The Socket Threat Research team categorized this operation as "Offside Wallet Theft Factory." Analysis reveals that these 40 extensions are not isolated; they share significant source code similarities and infrastructure overlaps with a broader set of 37 additional add-ons, bringing the total number of implicated extensions to 77. This suggests a centralized development effort focused on compromising Web3 assets.

The attack vector relies on social engineering and the trust users place in familiar wallet branding. Once installed, the extensions operate in the background, monitoring for cryptocurrency-related activity and exfiltrating any entered seed phrases or private keys to remote servers controlled by the threat actors. The report indicates that the extensions primarily target users interacting with DeFi platforms and NFT marketplaces.

Mozilla has been notified of the findings. The affected extensions have the potential to remain undetected for extended periods due to their deceptive branding and legitimate-looking permissions requests. Users are advised to audit their installed extensions and remove any that claim to offer wallet functionality but originate from unverified sources. The incident underscores the ongoing security challenges within browser extension ecosystems, particularly those targeting the rapidly growing cryptocurrency sector.