In brief – Security firm Socket has linked 77 Firefox extension identities to a campaign it calls the Offside Wallet Theft Factory, confirming 40 as malicious. – They impersonate OKX, Rabby Wallet and TronLink, capturing recovery phrases through fake wallet interfaces or…
dified versions of real wallet code. – Nine were published as sports-score apps before later versions replaced that function with wallet-stealing code. Firefox users have been targeted by a production line of counterfeit crypto wallet extensions, some of which spent months publishing live football scores before being quietly converted into tools for stealing recovery phrases
Socket’s threat research team published its findings last week, linking 77 extension identities through shared code, infrastructure and publishing patterns, and confirming 40 as malicious. Mozilla signing records place the campaign from March 9 to August 3, with several extensions still live when Socket reported them. Socket Threat Research uncovered a 77-extension Firefox campaign: 40 steal wallet secrets and credentials.
Another 37 posed as unrelated tools but displayed sports scores. Nine began as score apps before later updates turned them into wallet malware.https:// — Socket (@SocketSecurity) August 19, 2026 The malicious add-ons impersonate OKX, Rabby Wallet, TronLink and other Web3 products, often using characters that resemble the real names closely enough to pass a glance. Roughly half present a convincing wallet interface and ask the user to import an existing wallet, harvesting whatever recovery phrase or private key gets typed in.