Malicious Firefox Extensions Steal Crypto Recovery Phrases

A malicious campaign has been uncovered by security firm Socket, which has linked 77 Firefox extension identities to a fake wallet-stealing operation. The campaign, dubbed the Offside Wallet Theft Factory, confirms 40 extensions as malicious and targets users with fake versions of popular wallets such as OKX, Rabby Wallet, and TronLink.

The extensions impersonate real wallets, often using nearly identical names and logos to trick users into entering their recovery phrases or private keys. Some extensions even started as harmless sports-score apps before later updates replaced the code with wallet-stealing malware.

Roughly half of the malicious extensions present a convincing wallet interface, asking users to import an existing wallet and harvesting any recovery phrase or private key entered. Others collect saved credentials and clipboard contents, while some send stored account data to outside servers.