Malicious Firefox Extensions Steal Crypto Wallets in "Offside Wallet Theft Factory" Campaign A large-scale cyberattack, dubbed "Offside Wallet Theft Factory," has been targeting cryptocurrency users since at least March 2026, deploying 40 malicious Firefox extensions designed to steal wallet recovery phrases, private keys, credentials, and clipboard data. The campaign leverages cloned code, deceptive listings, and fake branding to impersonate trusted Web3 platforms, including OKX, Rabby Wallet, and TronLink. ### How the Attack Works The extensions masquerade as legitimate crypto wallets but either load remote phishing pages or embed theft code directly into their packages. Key tactics include: - Phishing via Remote Pages: Seven extensions, such as "0KX WEB3" (a spoof of OKX Wallet), used Supabase projects to dynamically load fake wallet interfaces. Victims were tricked into entering recovery phrases or private keys during "wallet import" processes, which were then sent to attackers. - Direct Theft Code: Fifteen extensions, many based on modified Rabby Wallet code, captured 12- and 24-word recovery phrases during wallet creation or import, transmitting them to Cloudflare Worker endpoints. Another 13 Rabby-based variants stole unencrypted wallet keyring data before local encryption, sending it to hardcoded HTTP servers (often on port 9000). - Credential & Clipboard Theft: Five extensions harvested user credentials and clipboard contents, including wallet addresses, passwords, and private keys, exfiltrating data to a command-and-control server at 77[.]91[.]100[.]175. ### Impact & Risks Once stolen, a recovery phrase or private key grants attackers full control over a victim’s crypto wallet, allowing them to transfer assets without the user’s password. Removing the malicious extension does not reverse the theft, as the attacker can restore the wallet on another device. ### Indicators of Compromise (IOCs) - Phishing URL: `hxxps://portal-web3-extension-welcome[.]pages[.]dev/home` - Supabase Project: `hxxps://kyfyvuwifdukctqyggto[.]supabase[.]co` (used for remote control) Mozilla’s security team removed the malicious extensions following disclosure, but the campaign highlights the persistent threat of deceptive browser extensions in crypto theft.