--- title: 77 Firefox Extensions Linked to Crypto Wallet and... description: Socket's Threat Research team identified a coordinated campaign of 77 linked Firefox extension identities, confirming 40 as malicious wallet or credential... canonical: https://daily.dev/posts/77-firefox-extensions-linked-to-crypto-wallet-and-credential-theft-elps8mawv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 77 Firefox Extensions Linked to Crypto Wallet and Credential Theft | daily.dev og:description: Socket's Threat Research team identified a coordinated campaign of 77 linked Firefox extension identities, confirming 40 as malicious wallet or credential... og:url: https://daily.dev/posts/77-firefox-extensions-linked-to-crypto-wallet-and-credential-theft-elps8mawv og:image: https://api.daily.dev/og/posts/elPs8Mawv.png og:image:alt: 77 Firefox Extensions Linked to Crypto Wallet and Credential Theft og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 77 Firefox Extensions Linked to Crypto Wallet and Credential Theft **[Socket](https://daily.dev/sources/socketdev)** · 26 min read · 0 upvotes · 0 comments ## Summary Socket's Threat Research team identified a coordinated campaign of 77 linked Firefox extension identities, confirming 40 as malicious wallet or credential stealers and 37 as deceptive sports-score shells used as cover or staging builds. The extensions impersonate wallets like OKX, Rabby, and TronLink, using techniques including Supabase-controlled remote phishing switches, Cloudflare Worker exfiltration of recovery phrases, modified Rabby code that leaks keyrings before encryption, and hardcoded C2 servers stealing credentials and clipboard data. Version histories show several identities transitioning from harmless sports-score or utility apps into wallet-stealing malware under the same Firefox extension IDs, revealing a shared publishing pipeline dubbed 'Offside Wallet Theft Factory.' Socket reported still-live extensions to Mozilla and published full indicators of compromise. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do malicious Firefox extensions steal cryptocurrency wallet recovery phrases? Several techniques were documented across a 77-extension campaign: some extensions load a remote phishing page via a hardcoded Supabase project that displays fake wallet-import screens; others embed modified Rabby wallet code that intercepts recovery phrases during wallet creation and sends them to Cloudflare Worker endpoints; and 13 variants exfiltrate serialized keyring data via persistAllKeyrings() before local encryption occurs. _daily.dev surfaces security research like this for developers auditing browser extension supply chains._ ### Why do some malicious browser extensions request only minimal permissions like storage and tabs? Extensions can steal wallet secrets without broad permissions because they rely on victims voluntarily entering recovery phrases or private keys into a convincing but fake wallet interface, rather than extracting data from browser storage or cookies. One fake OKX wallet extension requested only storage and tabs permissions yet still enabled complete wallet compromise through a remote-controlled phishing popup. _developers vetting extension permissions can follow ongoing coverage of extension-based threats on daily.dev._ ### How can extension version history reveal hidden malicious intent in Firefox add-ons? Extensions can be repurposed over time: an identity that first shipped as a harmless sports-score or utility app can later be updated under the same Firefox extension ID to include wallet-stealing code. Nine confirmed malicious identities in one campaign had earlier versions using football, basketball, NBA, or American football score shells before being weaponized, showing that reviewing only the current build misses this repurposing pattern. _daily.dev helps developers track emerging extension threat patterns like this repurposing tactic._ ## Similar posts on daily.dev - [108 Chrome Extensions Linked to Data Exfiltration and Sessio...](https://daily.dev/posts/108-chrome-extensions-linked-to-data-exfiltration-and-sessio--r4tdhhzt9) · Socket · 4 upvotes · 1 comments - [Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites](https://daily.dev/posts/two-chrome-extensions-caught-secretly-stealing-credentials-from-over-170-sites-pps6thkfj) · The Hacker News · 67 upvotes · 1 comments - [Over 100 Chrome extensions in Web Store target users accounts and data](https://daily.dev/posts/over-100-chrome-extensions-in-web-store-target-users-accounts-and-data-qecpawyca) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#crypto](https://daily.dev/tags/crypto), [#malware](https://daily.dev/tags/malware), [#firefox](https://daily.dev/tags/firefox) [View this post on daily.dev](https://daily.dev/posts/77-firefox-extensions-linked-to-crypto-wallet-and-credential-theft-elps8mawv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"77 Firefox Extensions Linked to Crypto Wallet and Credential Theft","url":"https://daily.dev/posts/77-firefox-extensions-linked-to-crypto-wallet-and-credential-theft-elps8mawv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/77-firefox-extensions-linked-to-crypto-wallet-and-credential-theft-elps8mawv"},"datePublished":"2026-08-19T20:31:48.461Z","dateModified":"2026-08-20T00:30:28.560Z","description":"Socket's Threat Research team identified a coordinated campaign of 77 linked Firefox extension identities, confirming 40 as malicious wallet or credential...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/57f2fc7bd670ab9f137551df6127b9d7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/57f2fc7bd670ab9f137551df6127b9d7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/77-firefox-extensions-linked-to-crypto-wallet-and-credential-theft-elps8mawv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,crypto,malware,firefox","timeRequired":"PT26M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"77 Firefox Extensions Linked to Crypto Wallet and Credential Theft"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/77-firefox-extensions-linked-to-crypto-wallet-and-credential-theft-elps8mawv#faq","mainEntity":[{"@type":"Question","name":"How do malicious Firefox extensions steal cryptocurrency wallet recovery phrases?","acceptedAnswer":{"@type":"Answer","text":"Several techniques were documented across a 77-extension campaign: some extensions load a remote phishing page via a hardcoded Supabase project that displays fake wallet-import screens; others embed modified Rabby wallet code that intercepts recovery phrases during wallet creation and sends them to Cloudflare Worker endpoints; and 13 variants exfiltrate serialized keyring data via persistAllKeyrings() before local encryption occurs. daily.dev surfaces security research like this for developers auditing browser extension supply chains."}},{"@type":"Question","name":"Why do some malicious browser extensions request only minimal permissions like storage and tabs?","acceptedAnswer":{"@type":"Answer","text":"Extensions can steal wallet secrets without broad permissions because they rely on victims voluntarily entering recovery phrases or private keys into a convincing but fake wallet interface, rather than extracting data from browser storage or cookies. One fake OKX wallet extension requested only storage and tabs permissions yet still enabled complete wallet compromise through a remote-controlled phishing popup. developers vetting extension permissions can follow ongoing coverage of extension-based threats on daily.dev."}},{"@type":"Question","name":"How can extension version history reveal hidden malicious intent in Firefox add-ons?","acceptedAnswer":{"@type":"Answer","text":"Extensions can be repurposed over time: an identity that first shipped as a harmless sports-score or utility app can later be updated under the same Firefox extension ID to include wallet-stealing code. Nine confirmed malicious identities in one campaign had earlier versions using football, basketball, NBA, or American football score shells before being weaponized, showing that reviewing only the current build misses this repurposing pattern. daily.dev helps developers track emerging extension threat patterns like this repurposing tactic."}}]} ```