Malicious Browser Extensions Steal Crypto Wallets in Sophisticated Attacks

A recent security report from Socket highlights a sophisticated attack on browser users, compromising their cryptocurrency wallets. In August 2026, Socket disclosed two campaigns involving malicious browser extensions for Firefox, Chrome, and Edge.

The first campaign, dubbed 'Offside Wallet Theft Factory,' affected 77 Firefox extensions, with 40 confirmed to be malicious. The attackers used shared code and infrastructure, but it's unclear if they were the same entity or separate groups. The malicious extensions posed as crypto products, VPN tools, password generators, or sports apps.

What's particularly concerning is that nine of these extensions started life as harmless sports score apps, which later received updates to install wallet theft code under the same identifier. This allowed them to inherit the installed base and accumulated positive reviews from their predecessors.