Socket's Threat Research team identified a coordinated campaign of 77 linked Firefox extension identities, confirming 40 as malicious wallet or credential stealers and 37 as deceptive sports-score shells used as cover or staging builds. The extensions impersonate wallets like OKX, Rabby, and TronLink, using techniques including Supabase-controlled remote phishing switches, Cloudflare Worker exfiltration of recovery phrases, modified Rabby code that leaks keyrings before encryption, and hardcoded C2 servers stealing credentials and clipboard data. Version histories show several identities transitioning from harmless sports-score or utility apps into wallet-stealing malware under the same Firefox extension IDs, revealing a shared publishing pipeline dubbed 'Offside Wallet Theft Factory.' Socket reported still-live extensions to Mozilla and published full indicators of compromise.
Table of contents
Supabase-Controlled Firefox Extensions Deliver Wallet-Phishing Pages #From Installation to Wallet Compromise #Remote Activation and Benign-Looking Cover #One Loader Template, Seven Extensions #Firefox Extensions Use Cloudflare Workers to Steal Wallet Secrets #Modified Rabby Code Intercepts Recovery Phrases #Counterfeit Wallets Collect Secrets Directly #Modified Rabby Extensions Exfiltrate Wallet Keyrings Before Encryption #Theft Inside the Persistence Workflow #Five Firefox Extensions Steal Credentials and Clipboard Data #Credential and Clipboard Collection #Shared Development Artifacts #37 Deceptive Firefox Extensions Repackage Sports-Score Apps #Outlook and Recommendations #Indicators of Compromise #MITRE ATT&CK #Questions this post answers
How do malicious Firefox extensions steal cryptocurrency wallet recovery phrases?
Several techniques were documented across a 77-extension campaign: some extensions load a remote phishing page via a hardcoded Supabase project that displays fake wallet-import screens; others embed modified Rabby wallet code that intercepts recovery phrases during wallet creation and sends them to Cloudflare Worker endpoints; and 13 variants exfiltrate serialized keyring data via persistAllKeyrings() before local encryption occurs. daily.dev surfaces security research like this for developers auditing browser extension supply chains.
Why do some malicious browser extensions request only minimal permissions like storage and tabs?
Extensions can steal wallet secrets without broad permissions because they rely on victims voluntarily entering recovery phrases or private keys into a convincing but fake wallet interface, rather than extracting data from browser storage or cookies. One fake OKX wallet extension requested only storage and tabs permissions yet still enabled complete wallet compromise through a remote-controlled phishing popup. developers vetting extension permissions can follow ongoing coverage of extension-based threats on daily.dev.
How can extension version history reveal hidden malicious intent in Firefox add-ons?
Extensions can be repurposed over time: an identity that first shipped as a harmless sports-score or utility app can later be updated under the same Firefox extension ID to include wallet-stealing code. Nine confirmed malicious identities in one campaign had earlier versions using football, basketball, NBA, or American football score shells before being weaponized, showing that reviewing only the current build misses this repurposing pattern. daily.dev helps developers track emerging extension threat patterns like this repurposing tactic.