40 malicious crypto wallet extensions have been discovered on Firefox, disguised as Rabby Wallet and other legitimate tools to steal users' mnemonic phrases.

Security firm Socket has discovered a batch of malicious crypto wallet extensions targeting Firefox users, linking them to a cyberattack campaign dubbed "Offside Wallet Theft Factory". To date, 77 extension identities have been associated with the campaign, of which 40 are confirmed malicious. The activity spanned at least from March to August 2026. The extensions mainly masquerade as popular Web3 wallets including OKX, Rabby Wallet and TronLink, luring users to import their existing wallets via highly realistic interfaces to steal mnemonic phrases or private keys. Approximately half of the extensions directly prompt users to input mnemonic phrases; 13 are tampered Rabby versions that exfiltrate wallet account data to external servers when users save their account information; another 5 extensions collect stored credentials and clipboard contents. Socket also found that at least 9 malicious extensions previously operated as sports score apps (covering soccer, basketball, NBA, etc.), building up user bases and positive reviews before updating their code to replace it with wallet-stealing scripts. Additionally, 37 extensions disguised as tools like password generators, VPNs and exchange rate converters actually run sports score programs. Socket warns that if users have entered mnemonic phrases or private keys into the relevant extensions, their wallet credentials should be considered permanently compromised. Uninstalling the extensions alone cannot reverse the leakage of already exfiltrated mnemonic phrases or private keys; users should immediately transfer their assets to a new wallet.