Forty malicious Firefox wallet extensions impersonating major DeFi wallets are actively stealing recovery phrases from users.
Security & Exploits ·
Security researchers at Socket have identified a coordinated campaign deploying 40 confirmed malicious Firefox extensions that impersonate OKX, Rabby Wallet, TronLink and other Web3 products. The extensions harvest recovery phrases and private keys by presenting fake wallet interfaces or using modified versions of legitimate wallet code. Socket traced 77 extension identities to the operation—dubbed the Offside Wallet Theft Factory—through shared code, infrastructure and publishing patterns, with malicious activity spanning from March 9 to August 3.
The campaign employed a deceptive layering strategy: nine extensions initially published live sports scores before later updates silently replaced that functionality with wallet-stealing code, retaining their accumulated user base and review history. Another 37 identities continued operating as legitimate-looking tools like password generators, VPNs and currency converters while running sports-score applications. About half of the malicious extensions used convincing wallet interfaces to trick users into entering credentials, while 13 others modified Rabby's code to exfiltrate stored account data to external servers, and five harvested clipboard contents and saved credentials instead.
Socket cautioned that users who entered recovery phrases or private keys into any of these extensions should immediately consider those credentials permanently compromised, as uninstalling the extension does not revoke data already transmitted to attackers. The researchers have not established whether a single operator controlled all identities in the campaign. Several malicious extensions remained live when Socket published its findings.