77 Firefox Extensions Linked to Crypto Wallet and Credential Theft

The 'Offside Wallet Theft Factory' campaign involves 77 Firefox extensions designed to steal cryptocurrency wallet secrets and credentials. Among these, 40 extensions are confirmed malicious, exfiltrating recovery phrases, private keys, and credentials through infrastructure controlled by the attackers, including Supabase remote switches and Cloudflare Workers. Another 37 extensions transitioned from benign utilities to malicious wallet stealers, sharing publishing artifacts and version histories. The campaign targeted Web3 users by impersonating known cryptocurrency products and operated from at least March to August 2026. Techniques include phishing interfaces embedded in extensions, modification of wallet code, and direct credential theft, facilitating immediate theft of cryptocurrency assets.

Users of the affected Firefox extensions risk immediate theft of cryptocurrency assets due to exfiltration of wallet recovery phrases, private keys, and credentials. The campaign enables attackers to gain full control over victims' wallets, leading to financial loss. The impersonation of legitimate Web3 products increases the likelihood of successful credential theft. The widespread nature of the campaign, involving 77 extensions, indicates a significant threat to the Web3 user community.

No specific patch or remediation is indicated for the affected extensions. Users should immediately uninstall any suspicious or untrusted Firefox extensions, especially those impersonating cryptocurrency wallets or utilities. Review installed extensions for any that match known malicious names or behaviors associated with this campaign. Avoid installing extensions from unverified sources. Monitor official Firefox and cryptocurrency wallet advisories for updates or removal of malicious extensions. Vendors and browser stores should remove identified malicious extensions to prevent further harm.