Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

77 Firefox Extensions Linked to Crypto Wallet and Credential Theft

0
Medium
Published: 08/20/2026 (08/20/2026, 01:03:13 UTC)
Source: AlienVault OTX General

Description

Socket identified a coordinated campaign involving 77 Firefox extensions designed to steal cryptocurrency wallet secrets and credentials. The operation, tracked as 'Offside Wallet Theft Factory', includes 40 confirmed malicious extensions that exfiltrate recovery phrases, private keys, and credentials through Supabase-controlled remote switches, Cloudflare Workers, and hardcoded command-and-control infrastructure. An additional 37 deceptive sports-score shells share publishing artifacts and version histories showing transitions from benign utilities into wallet-stealing malware. The campaign operated from at least March 2026 through August 2026, targeting Web3 users through impersonations of OKX, Rabby Wallet, TronLink, and other cryptocurrency products. Extensions capture secrets through phishing interfaces, modified wallet code, and direct credential theft, enabling immediate cryptocurrency theft and financial harm.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 08/20/2026, 08:42:34 UTC

Technical Analysis

This threat involves a large-scale, coordinated campaign leveraging 77 Firefox extensions to steal cryptocurrency wallet secrets and credentials. The operation, tracked as 'Offside Wallet Theft Factory,' includes 40 extensions confirmed to be malicious, which exfiltrate sensitive data like recovery phrases and private keys via Supabase-controlled remote switches, Cloudflare Workers, and hardcoded command-and-control servers. Another 37 extensions started as benign utilities but transitioned into malicious wallet-stealing tools, sharing publishing artifacts and version histories. The campaign has been active from at least March 2026 through August 2026 and targets Web3 users by impersonating well-known cryptocurrency products. The attack methods include phishing interfaces, code modification of wallets, and direct credential theft, enabling attackers to steal cryptocurrency immediately upon compromise.

Potential Impact

The campaign enables attackers to steal cryptocurrency wallet recovery phrases, private keys, and credentials, leading to immediate theft of cryptocurrency assets and financial loss for affected users. The use of legitimate infrastructure like Supabase and Cloudflare Workers for data exfiltration complicates detection and mitigation. The impersonation of trusted Web3 products increases the likelihood of user deception and successful credential theft.

Defensive Guidance

No official patch or remediation is provided for this campaign as it involves malicious third-party browser extensions rather than a software vulnerability. Users should immediately uninstall any suspicious or untrusted Firefox extensions, especially those impersonating cryptocurrency wallets or utilities. It is recommended to verify extensions only from official sources and maintain vigilance against phishing attempts. Browser vendors and security teams should monitor and remove malicious extensions from official stores. Users should also consider resetting or migrating wallets if compromise is suspected.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Author
AlienVault
Tlp
white
References
["https://socket.dev/blog/firefox-crypto-wallet-theft"]
Adversary
null
Pulse Id
6a865251c21fa835e97512b4
Threat Score
null

Indicators of Compromise

Domain

ValueDescriptionCopy
domainbrowser-app.com
domainbrowsify.net
domaingemachriverdale.org
domaine-wl.com
domainwebbrol.com
domaindevplugs.co
domaintabtools.org
domaintools.com
domainwebtools.com
domainprotools.com
domaincleankits.co
domainwebtools.net
domainextlab.org
domainaddonslab.com
domainlinktools.co
domainbrowsify.co
domainextlab.co
domainwebtools.org
domainaddonslab.net
domainaddonslab.org
domaindevplugs.com
domainproaddons.net
domainbrowsertools.com
domainsmartext.co
domainextrakits.com
domainplugify.co
domainfoxplugin.co
domainwebtools.co
domainbrowsertool.com
domainlive-scores.com
domainsmartext.net
domainextrakits.co
domaintabtools.com
domaindevblogs.com
domainwebtoolbrowser.com
domainquickext.co
domainneattools.org
domainfasttools.co
domainnetplugs.net
domaintabtools.net
domainwebkits.co
domainlinktools.org
domainfoxplugin.net
domainneattools.co
domainquickext.org
domainprotools.net
domainalt.e-wl.com
domainconsol.e-wl.com
domainfirebase.e-wl.com
domainid.gemachriverdale.org
domainmapid.e-wl.com
domainommid.e-wl.com
domainpch.e-wl.com
domainrest.e-wl.com
domaintemple.e-wl.com
domaintypec.e-wl.com
domainv1.basketball.api-sports.io
domainv1.hockey.api-sports.io
domainv2.nba.api-sports.io
domainvala.e-wl.com

Hash

ValueDescriptionCopy
hash08b7b064fa9a41b06774315d944ffddff705ab727222a0c3bcac64a77553bf2f
hash4d0912d575087dab5f468214a2fd259bc386472a8b2b93b6e2441cde4bd941cb
hash26427220b9965e22deca0e617657c2c65b78f750183355d1265c147818367bd7
hash252119fc48ad93b0c930d7a62fb49420cf8986716539e4e9d4d5c1bad700d435
hash3c0f0413ca6326bd0107d532aec4daad7feec663d072f7c992682fb702b64cce
hash31dc33e75aa2a9e64eac98467c5a516201e208d68ffe10d07800350ce1a44197
hash9c6f173418245a953d5fc3e9ec69f09b7aee8563127042a995ad172de9cdb88d
hasheeb1969d0c8b250976ec220f40236ddd7eb6863556379d17e1dd4078b5531751
hash6408b6a2c4000e74cde94d3ce31ada5e024d80782199e8010d6ef482686e687b
hash8590d1a22fdf42a363fe41fe6dc2cb03e616cc6d413f63d2ade9fd3ab54f1c83
hashedcdbcdbea729fb11cbb0a353c3a9025e5a29de48fcd86e3948df738bf82b2aa
hash6a3c00936b7f62652eb4970b2bd3bb895fdd9ec1ebae1dab19f0c50cfbdc6b4c
hash88d5b16c767e2527c14d2ae25dca6f4fe19f69517d0e00a2f26be055c575e3fe
hashacf6f82916e78b2e5326fd16d6c97206532305cf5d68ea21e1a30537bffd26c0
hash547a878083e4e3c39c240f27e9caaa190ef04661f46468234987980d907d9834
hash8cec7990d4bc5e45034796fc63c63ba16781ac4303925ed1e80036668a9fe48e
hash46c40d3cefb10a9fd1dfeb03ff1dc550674d391bdf05c0294257809d51c254a8
hashaa9d8f30bd6e0633af5bb0fa16ed2e87fcd22e87725c48a5c96884465e262a28
hash5a7227dbf8e5c5c73f11c7df221c080252b337cb96b21f462d5ef17525f00f16
hash39827e214c31dbbf0ce20a40ee019cca2d96d621bf90dac4edc8b85a86311d09
hashc7435c1659b6e0dc83487d03b3389ec22bb7e435c9b4c85a81f6c6504466060b
hash2b0d50aa0edf4f65e21b015fee169d68dc870a89d242836ccb3c7cef84db04c4
hash71f74a903b12fdaa1cb7683599b7956602768f23934578171f6453fdee7b3eac
hash3e4cd172c21c0c0d72c762fe84f07a9eb8f7c82f15add36bdf934ee42accf776
hash918332da18e0f26378ee84408be13930da2d66cd80153cf18a5aa3d6d0cb2271
hashfd67f4a3c8993b1ce6aecf0cc8902e6a8535a6ef56c0bad42d7e936d0a17e060
hash894398430972f91db2f1916f9fbe28b7319cb0e7d0e91a51e764fda5e7d1e8c9
hashbee995e253092c8c8edfa4104799adbe40967596dfdb28a5668390aea40d0883
hash66150abf5072f0d02118648d072afecdc8bac1d224dbc569836a65398d48e98d
hash46305296e0675147c7b4ceacc7d5e45dd44d5d2242c0c3e02b444931b3e1564b
hashe4c3a669362e8b456b1d6c8e6df7da2a9605a42d710d0cc951342b7ac0cb9d72
hashaeb6240b2f40a177999f68ae6fc88e511669d501aa298a433b05bafa89210685
hash172b7618498d1c9da6ff6aecc8f680d2b3956b7c86d80fbc060e0adae8f38ebf
hashe335066fb09d0d9d0e5fd55b946d430071fb6f157bdb9b38e7f50714178a51eb
hash61a19cab5c7bbcf5ded1c8b6a05d586ecbe03afc055c132049226f86f5127b3d
hash54d57acdd0557e22f9dd1350ac1bf1f536dd5859394b39cf9ba586b3d2339f05
hash40f6611eacbcf10f6260f91caeb4a2223313f466340f3ea9d47d6e34ee8b889a
hash6db5ea393b1618259fee5a2ca7467be47ea025255d2ab45a78b76e23e4e0b59e
hash5c8121bd3394c4ea6d273a6936aeaa7d30aa748a978b440d7144819522813153
hashf0d262d1b1e446ee1a6db37b0301b9e2ab160269b193920212d55d7dfb231fe1
hash61659464d6ac002757b51c276f22cd3fff25089c1dc257c0b81309bf49aba7c0
hash5dd33e0737e82b2e324dc4c04ce862da185153d54705697cfd0181e848bf35d4
hash0e163cde2337fbc11232b548e301dea746b764b898e0decbfcc7940248d4f092
hash56a6dbde57aab6ab2f4f1d5af1d6fbc3e775a600026382e56df7ef5363c50d4d
hashe4f351a6d6a8249691eec07223c74ca9c8708522919e1626baef705acb1ad87d
hash1b3634aec03d85d9e7463e363b6664e9105f17badfa5f1cf737b1623267ae631
hashd671be66381149dc7efb9c77f081fc1e3410cbf2447fe7652b77b08f895503d8
hash1857acb44d3e577645f7ca64e76a14609d960c6a6efa56ea00c28ac43df4463f
hashb44c7cd048bbe7f165fd28a755765c978373ee6761b6ae306ba57e9e1895536b
hash36b8cbed79b91b92e84eb01d61c57c8972cacc68a3d6a3629e2a2b25a59ee11d
hash716cc37e2019a92ab1970d74e3ee962cafb4eef97fbd55353f15a34c8e0c2a30
hasha3d9369e666aeb7230956bd6dd97b7337b829c5ae5139171e90593de17dc9b08
hash790c869021cf7584271c73cb4eac8a094595e7225f69acc1a4b145903b2bc1c2
hash894109c97ccb215f523e41bc968ffa7716959c62c7c3f625cf4c03d50e899072
hasha2eba930f94306f2f4f27b74351c1ce0a75210bac51d9efa09c71d69d3cb9990
hasha3a31d7338b047de63b5c92a8d697292a26b0fccb4797918462139b8767d97f8
hashf70febe6549d1439cf1f140cae18f13e7150ffe4ca31e3e00656b878a0153366
hash96d03bb2b8a59db38200278dc17fbafc14c55795a126068f3e7a3fc7a749730f
hash1429f5134b5acf5077a18cf805bc905393524debad75f70a942ec30608f49088
hash708291399f6d98529e02a1d0100084abfe1e09d3fb7d8fefad744f1e7f439420
hash2fb5b89c0889a8bde90845de2db13161f6d8845fa5dbc56bfa474f800c664d9e
hashed63c3a14b51915863bbc443f169dccb73baebdc4e553cdfe18ef1a68b72ffb2
hashfc74265e10942ee96726c7cce9b642cc7492835cb4eb43d4451bd2aab13e1ec8
hash57d78328f2cd02e91e511fbee80fc2dc43368adf0c84fac4cc0bbbce3fad5d8a
hash3f52fcb79e2b8e255030b1270f22618417e622e65406cf6e3e715e2f0a80b9e3
hashe7ef1558ecba876e2786e5f281d5551e2ab161c52f3443e5c81f4ffd0ba17d5b
hash793a2d26dc9781bbf3e61db85009626f7de9edc19bddc349f29b4cf74d1b184e
hashbdcb3789c063a06369ff73906d7776846a163d6c60ff8dbcc549bc2dfe5ea382
hash96be1669cbc95c35a5448311fb808cf915ea89cdee983ae905f903f9fcb5bb6d
hash7d950ad43d7e83f8f84a2033f88349d384972a9b69cde3cc2ca1ee28e1be94ed
hashaf69e15e02d4c2850a6ed26e9d7d1152e16e2d7d01695bbf3b3840adf0b6bee5
hash5bebc15d404c4f7314f4e4cd7e24aff1178de124374128bc845a034e3f6c9853
hash14a2da218e41d3854e731d02f8a444a1b9712ba2788d57b5a76c18737bd559ae
hash1753fa38657c6c0d23ff7ca12a768a1b23ac3d8f3896c746ae2bdc7538c03009
hasheec0638729b096e0d0f93173be9b105b15371b76c167dfa89e5a882ee290d9cb
hashb8b5ad5c18626e11bf4960a8245539334367be6655bd4c21140bb27c82efb679
hash3f73e8af9eb2d664be44e07955253a59c5dab684c645ab648f36c2cbccddcdb3
hasheb4718f52161d2262e9aa83b4b561fa475486f5183600376d002be3333823787
hash1381fc82afd785cb0dfc2cf511ed49d4487cb9cd4edee9f741b38710624a1bd0
hash2a0856637d0e3850b153713ef34d1963b6d6b06acaa1e4fbdc6fa305483987ca
hashd5c5331b82771fe91213c246d076ad6d08157b5390fabb4a1d7209b1a5db15dd
hash68b25a9761e04f3c68af6d94e2ad3ca259ebbaf06e90798d6c2613ddc3e434c4
hash5dcbce26e54dd44d0b932e23f1a741298d4e35487d1868b469518f903e577a7a
hashe0373ebe9eec5ec6734bbbd012fc9874c78b35f7cd444e9df1461f8d03d3b0d0
hash5328d5e600d1de7e4ffe8bd38dd1fdf22f1226b21c4d77db10aca7c9ce31c2a8
hash1cbe34e76e4ebb1e8b185f67e8f5bc507427af7692512b9e6a93ec6051685d95
hashb65143df86edd60625fcbc0fcb396ef02baae6e731c1993e70873563e5a1524c

Url

ValueDescriptionCopy
urlhttp://id.gemachriverdale.org:9000/hook/ptvve
urlhttp://id.gemachriverdale.org:9000/hook/rra
urlhttp://id.gemachriverdale.org:9000/hook/pastre
urlhttp://alt.e-wl.com:9000/hook/alt
urlhttp://consol.e-wl.com:9000/hook/cosomid
urlhttp://firebase.e-wl.com:9000/hook/see
urlhttp://mapid.e-wl.com:9000/hook/mapid
urlhttp://ommid.e-wl.com:9000/hook/ommid
urlhttp://pch.e-wl.com:9000/hook/pch
urlhttp://rest.e-wl.com:9000/hook/rest
urlhttp://temple.e-wl.com:9000/hook/temple
urlhttp://typec.e-wl.com:9000/hook/typo
urlhttp://vala.e-wl.com:9000/hook/value
urlhttp://77.91.100.175/html/app.php
urlhttp://77.91.100.175/html/continue.php
urlhttps://v3.football.api-sports.io/fixtures?live=all

Ip

ValueDescriptionCopy
ip77.91.100.175

Threat ID: 6a86b942acd9273b4955b7f7

Added to database: 08/20/2026, 08:22:26 UTC

Last enriched: 08/20/2026, 08:42:34 UTC

Last updated: 08/20/2026, 10:52:01 UTC

Views: 5

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses