> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Malicious Firefox add-ons caught stealing cryptowallet seed phrases and browser credentials - URL: https://f4n6.co.uk/security-feed/malicious-firefox-add-ons-caught-stealing-cryptowallet-seed-phrases-and-browser-credentials/ - Published: 2026-08-24T20:51:35.000Z - Updated: 2026-08-24T20:51:35.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Security researchers at Socket have identified 77 linked malicious Firefox extensions — 40 confirmed as active info-stealers — in a campaign dubbed "Offside Wallet Theft Factory," active since at least March 2026\. The extensions masquerade as legitimate Web3 products (OKX, Rabby Wallet, TronLink) and utility tools (VPNs, password generators, note-taking apps), using a cloud-hosted Supabase database as a kill-switch to toggle between harmless decoy behaviour and credential-harvesting interfaces. The bottom-line risk for EMEA financial services is direct: any employee or customer using these extensions on a managed or BYOD workstation could surrender cryptowallet seed phrases and browser credentials, enabling both personal financial loss and potential corporate account compromise if reused credentials are involved. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18: classification of ICT-related incidents and cyber threats | A campaign of 77 malicious browser extensions actively stealing credentials constitutes a cyber threat requiring classification by severity and impact. | Clients must classify detections of these extensions as ICT-related incidents under their DORA taxonomy and feed the classification into their incident management process. | | DORA Art. 17: ICT-related incident management process | The extensions use a remote database toggle (Supabase) to activate theft functionality, meaning detection of the add-on is not sufficient — the incident management process must account for the fact that exfiltration may have already occurred before removal. | Incident response procedures must include credential rotation and forensic review of wallet/credential exposure, not just extension removal. | ## 3\. Technical analysis & attack chain **Attribution caveat:** No MITRE ATT&CK actor profile has been resolved for this item. The campaign name "Offside Wallet Theft Factory" is attributed to Socket Threat Research; attribution to a specific threat actor is unconfirmed. ### Attack chain (confirmed from source material) 1. **Initial access — typosquatting and social engineering.** Attackers publish malicious Firefox extensions on the Firefox Add-ons store, mimicking legitimate Web3 products. A confirmed example is "0KX WEB3" — using a zero (0) instead of the letter "O" to impersonate the OKX cryptocurrency exchange. Other impersonated brands include Rabby Wallet and TronLink. 2. **Low-permission installation.** The extensions request a minimal number of permissions, reducing scrutiny during installation. The source explicitly notes that low permission count does not equate to safety. 3. **Remote configuration via Supabase.** Upon each open, the extension silently queries a database hosted on Supabase (a legitimate cloud backend service). This database acts as a command-and-control toggle: attackers can flip a switch to change the extension's runtime behaviour without pushing an update through the Firefox Add-ons store. 4. **Decoy phase.** By default, the database toggle directs the extension to display a harmless decoy interface — e.g., a notepad, sports score tracker (NBA, hockey, football), or password generator. This builds user trust and evades automated review. 5. **Activation — credential harvesting.** When the attacker flips the database switch, the extension swaps its UI to a convincing wallet-import page prompting the user to enter their recovery/seed phrase. There is no actual wallet code inside the extension — it is purely a credential-harvesting front. 6. **Exfiltration.** Entered seed phrases are transmitted to the attacker-controlled backend. The source does not specify the exfiltration protocol or endpoint beyond the Supabase infrastructure. 7. **Evolution via update.** Several of the 40 confirmed info-stealing extensions began life as benign sports-score trackers and were later updated to swap the scoreboard UI for the wallet-theft interface. This demonstrates a two-stage delivery model: pass review as benign, then pivot to malicious. ### Campaign scope - 77 linked extensions identified, sharing source code and infrastructure overlaps. - 40 confirmed as actively stealing information (cryptowallet seed phrases, password details). - 37 presented as VPNs, password generators, or note-taking tools with sports-score tracking code. These did not contain confirmed malicious code at time of analysis but share infrastructure with the stealing extensions and are treated as high-risk. **Single-sourced caveat:** The technical detail above is corroborated between Bitdefender/Hot for Security and The Hacker News, both citing Socket Threat Research as the primary source. The specific Supabase toggle mechanism, the "0KX WEB3" extension name, and the 77/40 extension counts originate from Socket's research as reported by these outlets. No independent confirmation from Mozilla or a second research team is available in the provided sources. ## 4\. Mitigation & containment ### P1 — Within 24 hours - Audit all managed Firefox installations for extensions matching the campaign profile. Search for extension names impersonating OKX, Rabby Wallet, TronLink, and any Web3/cryptowallet-related add-ons not on your approved list. Specifically look for "0KX WEB3" (with a zero). - Block installation of unsigned or unapproved Firefox extensions organisation-wide via enterprise policy (`ExtensionSettings` in `policies.json` or Group Policy). - If any matching extensions are found: remove the extension, treat the host as compromised, and force rotation of all credentials entered in that browser profile since the extension's installation date. Assume seed phrases and passwords have been exfiltrated. ### P2 — Within 72 hours - Review Firefox extension allow-lists and remove any sports-score trackers, note-taking tools, password generators, or VPN extensions that are not from verified, reputable publishers — these match the decoy profile used in this campaign. - Deploy EDR/browser-monitoring rules to flag any Firefox extension making outbound connections to Supabase endpoints (`*.supabase[.]co`) unless explicitly approved. - Notify customers (if applicable) of the campaign via security awareness channels, specifically warning against installing wallet-related browser extensions from the Firefox Add-ons store without independent verification. ### P3 — Within 7 days - Implement browser extension governance: maintain an explicit allow-list for Firefox (and Chrome) extensions, enforce via MDM or GPO, and require security review for any new extension request. - Review historical browser extension logs (if available via MDM or endpoint telemetry) to identify any of the 77 linked extensions that may have been installed and removed prior to detection. - Monitor Mozilla/Socket advisories for the full list of 77 extension identifiers, which was not published in the provided source material. ## 5\. Indicators of compromise No atomic indicators (extension IDs, hashes, Supabase project URLs, or domains) were published in the provided source material. The sources describe observable behaviours but no machine-pivotable artefacts. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | | Firefox extension named "0KX WEB3" (zero instead of letter O) | Firefox Add-ons manager (about:addons), extension management telemetry | High — named in source | | Extension making outbound requests to Supabase infrastructure on launch | Network telemetry, EDR, proxy logs, DNS logs | Medium — Supabase identified as C2 channel but no specific project URL provided | | Extension UI switching between decoy (notepad, sports scores, password generator) and wallet-import prompt | Endpoint screen capture, user report, browser extension behavioural analysis | High — described in source | | Sports-score tracking extensions (NBA, hockey, football) sharing code/infrastructure with confirmed info-stealers | Extension code analysis, extension store review | Medium — 37 extensions flagged but not all confirmed malicious | ## 6\. Detection Insufficient indicators to author detection rules. The source material does not provide extension IDs, file hashes, specific Supabase project URLs, hard-coded strings, or other artefacts suitable for YARA or Sigma rule construction. The behavioural indicators above (§5) should be operationalised as manual review procedures until Socket publishes the full extension list with atomic identifiers. ## 7\. Sources - Bitdefender / Hot for Security — "Malicious Firefox add-ons caught stealing cryptowallet seed phrases and browser credentials" — https://www.bitdefender.com/en-us/blog/hotforsecurity/malicious-firefox-add-ons-stealing-cryptowallet-seed-phrases-browser-credentials — 2026-08-24 - The Hacker News — "40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets" — https://thehackernews.com/2026/08/40-malicious-firefox-extensions-pose-as.html — 2026-08-24 ## 8\. Adverse Trace position This is a medium-severity threat with high impact for affected users. The campaign is technically unsophisticated but operationally clever — the Supabase database toggle avoids the need for malicious code updates through the extension store, and the low-permission profile evades automated vetting. For EMEA financial services, the primary risk is credential compromise on employee workstations (BYOD or managed) that could lead to unauthorised access to corporate systems if browser-stored or reused credentials are harvested. The 37 unconfirmed-but-linked extensions are a latent risk: they could be toggled to malicious behaviour at any time. We will monitor for Socket's full publication of the 77 extension identifiers and update this advisory with atomic IOCs and detection rules when available. Clients should treat any non-approved Firefox extension matching the campaign profile as a confirmed incident, not a hygiene finding. --- [Read the original source →](https://www.bitdefender.com/en-us/blog/hotforsecurity/malicious-firefox-add-ons-stealing-cryptowallet-seed-phrases-browser-credentials?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*