Firefox Faces 77 Fake Wallet Extensions: The ‘Offside’ Crypto Theft Factory

Firefox users have fallen victim to a stealthy crypto‑wallet theft operation involving counterfeit extensions.

The Offside Factory: 77 Extensions, 40 Threats

Socket Threat Research identified 77 distinct extension identities under a single campaign, flagging 40 as genuine theft tools. The remaining 37 masqueraded as sports‑score apps but secretly collected data.

Target Demographic: Crypto Enthusiasts and Sports Buffs

The extensions mimicked well‑known Web3 products such as OKX, Rabby Wallet, and TronLink, requesting only two permissions—storage and tabs—to harvest users’ recovery phrases and private keys.

Dual‑Layered Stealth Tactics

■Name Impersonation: Characters closely resemble legitimate product names.

■Covert Data Exfiltration: Rabby‑based extensions transmitted stored account data to external servers while appearing normal.

■Clipboard Hijacking: Five extensions captured clipboard contents.

■Minimal Permissions: One extension waited for a recovery phrase after loading a remote page.

Company and User Impact

■The use of brand names like OKX, Rabby, and TronLink undermined trust.

■Active from March 9 to August 3; some extensions remain live.

■Users’ recovery phrases and private keys were compromised; funds should be moved to fresh wallets.

Industry‑Wide Ripple Effects

This incident mirrors similar tactics seen in Chrome extensions, pirated software, fake Mac clipboard apps, and Steam‑distributed games—highlighting the need for heightened vigilance in the digital‑asset ecosystem.

Defensive Measures

■Only install verified extensions from reputable stores.

■Enforce two‑factor authentication (2FA) and use a password manager.

■Scrutinize extension permissions; grant only what’s necessary.

■Never enter a recovery phrase into a browser or extension.

Cem Talu: This campaign underscores how invisible threats can erode confidence in crypto infrastructure and trigger sudden liquidity swings. Investors must cultivate not just technical acumen but a robust security mindset to safeguard their digital assets.