Security researchers at Socket have uncovered a campaign they call “Offside Wallet Theft Factory” — a cluster of 40 confirmed-malicious Firefox browser extensions that impersonate popular cryptocurrency wallet apps including OKX, Rabby Wallet, and TronLink, along with a broader set of 77 add-ons sharing the same infrastructure. Active since at least March 2026, the extensions use a mix of techniques: 15 directly capture seed phrases, private keys, and wallet secrets and send them to attackers via Cloudflare Workers; 13 are modified Rabby Wallet builds that exfiltrate serialized wallet keyrings before local encryption can protect them; and seven use remote switches hosted on Supabase to dynamically serve phishing pages or benign-looking decoy content depending on the situation.
What makes this campaign particularly persistent is how the attackers rotate their disguises. Several extensions first appeared on Mozilla’s official add-ons marketplace as sports-score widgets or utility tools — football scores, dark mode toggles, VPN launchers — before the same Firefox extension ID was quietly repurposed into a wallet-stealing payload under an identical listing. That trick lets attackers inherit existing user ratings and install counts, making the malicious version look trusted. A single compromised seed phrase is enough to drain an entire wallet, and the researchers note that the economics favor the attackers: repeatedly publishing disposable extensions is cheap, while each successful theft can be worth far more than the effort required.
How to check if you’re affected
Affected products include any Firefox installation with a Web3 wallet extension installed from the Firefox Add-ons store, particularly any extension claiming to be OKX, Rabby Wallet, or TronLink. Open Firefox’s Add-ons Manager (about:addons), review every installed extension, and remove anything you do not recognize or that you installed from a source other than the official wallet developer’s website. If you use Rabby Wallet, verify the extension’s version history and publisher directly on GitHub or the official Rabby site — affected versions were published as modified Rabby builds. If you suspect a compromised extension was installed, treat the associated seed phrase or private key as exposed and transfer funds to a new wallet immediately.