A recent cybersecurity threat has emerged involving 40 Mozilla Firefox extensions that impersonate popular Web3 products such as OKX, Rabby Wallet, and TronLink to steal cryptocurrency wallet information. This campaign, identified as 'Offside Wallet Theft Factory', has been active since March 2026 according to the Socket Threat Research team. These extensions are part of a broader group of 77 browser add-ons that share similar source code and infrastructure, reflecting a sophisticated and coordinated effort to deceive users.

Security researcher Kirill Boychenko revealed that these extensions use a mix of tactics to achieve their malicious goals. Seven of the extensions utilize Supabase projects to serve phishing or decoy content, while others capture sensitive information like recovery phrases and private keys, exfiltrating them through Cloudflare Workers. Additionally, some variants modify Rabby Wallet builds to steal serialized keyrings before they are encrypted locally.

The extensions employ two primary methods to steal wallet secrets: either by loading a fake wallet page remotely or by embedding the malicious functionality directly into the extension. Initially, some of these add-ons appeared as legitimate sports score or utility extensions on Firefox's official marketplace, only to later transform into tools for wallet theft.

Furthermore, 37 related extensions, although not directly involved in wallet theft, display deceptive behavior by posing as sports score apps for various sports and integrating legitimate services like API-Sports while simultaneously offering unrelated utilities. Historical data shows that some malicious extensions previously masqueraded as sports-score tools before being repurposed for wallet theft.

The threat actors behind this campaign have leveraged the economics of cybercrime to their advantage, frequently republishing disposable extensions under new names and IDs. By rotating identities and separating malicious functions across different extensions and cloud infrastructure, they maintain a persistent presence in the Firefox Add-ons ecosystem despite individual extensions being short-lived.