Every time you add an extension or plugin to your browser, there's a risk that you might be doing more than managing your cryptocurrency wallet, generating passwords, taking notes, or tracking sports results. There's a chance that you have just handed a complete stranger access to your savings.
Security researchers at Socket have identified scores of malicious linked Firefox add-ons designed to steal cryptocurrency wallet seed phrases or password details.
The campaign, which researchers have dubbed the "Offside Wallet Theft Factory", has been running under the radar since at least March 2026.
One example of a malicious extension is called "0KX WEB3" (which uses a zero rather than the letter "O" in an attempt to mimic the OKX cryptocurrency exchange).
The malicious extension - which the developers boldly claim collects "no data" - looks like a wallet app, but the truth is that there is no wallet code inside it.
Behind the scenes, the extension silently checks a database on Supabase, a legitimate cloud service, every time it is opened. Hackers controlling the database can decide what happens next.
By flipping a switch in the database, the attackers can toggle the extension's behaviour - most of the time it shows a harmless decoy, like a notepad, but on command it swaps to a convincing-looking page inviting users to import their wallet.
Victims who enter their recovery phrase there hand it straight to the attackers. Because the switch lives in the database rather than the extension code, criminals never need to push an update through the Firefox Add-ons store to activate it.
What is so crafty about this is that the extension itself does so little. It only requires a minimal number of permissions to install. That's a useful reminder to everyone that just because an extension asks for very few permissions does not mean it is automatically safe.
Out of the 77 linked extensions, 40 were confirmed by security experts to steal information.
The remaining 37 presented themselves as VPNs, password generators, or note-taking tools — but secretly ran code that tracked NBA, hockey, or football scores. Although the researchers did not find that these extensions presently contained malicious code, the fact that they shared code and infrastructure with the info-stealing Firefox extensions raises alarm.
In fact, several of the extensions that have been confirmed to steal cryptocurrency wallet started as one of the same sports score shells - and only later got "updated" to swap their scoreboard for something that could end up draining a victim's finances.
Cybercriminals have used browser add-ons as a route into crypto wallets many times before.
For instance, in 2020 I wrote about 49 Chrome browser extensions that could steal passphrases and private keys, propped up with fake five-star reviews. More recently I described how over 100 malicious Chrome extensions had been caught stealing Google and Telegram data from 20,000 users, and this April how fake ChatGPT extensions were stealing login credentials.
Cybercriminals have learnt that if you dress malware up as something that people want, they can sit back and wait for the riches to roll in.
So, what can you do to better protect yourself?
tags
Graham Cluley is an award-winning security blogger, researcher and public speaker. He has been working in the computer security industry since the early 1990s.
View all posts
Facts Only
* Socket security researchers identified 77 linked Firefox add-ons.
* The campaign is named "Offside Wallet Theft Factory."
* Activity has been observed since at least March 2026.
* 40 extensions are confirmed to steal cryptocurrency seed phrases or passwords.
* 37 extensions provide NBA, hockey, or football scores.
* One specific extension is named "0KX WEB3."
* The extensions utilize Supabase, a cloud service, for remote command and control.
* Attackers can remotely switch the extension's display between a decoy and a wallet import page.
* Some confirmed theft extensions originally functioned as sports score tools.
* The extensions require a minimal number of installation permissions.
Executive Summary
Security researchers at Socket have uncovered a coordinated campaign, termed the "Offside Wallet Theft Factory," involving 77 linked Firefox add-ons. While 40 of these extensions are confirmed to steal cryptocurrency seed phrases and password details, the remaining 37 currently function as sports score trackers. However, these non-malicious shells share infrastructure with the theft-oriented extensions, and evidence shows some previously benign sports tools were later updated to include data-stealing capabilities.
The attackers utilize a legitimate cloud service, Supabase, to remotely control the extensions' behavior. By modifying a database switch, they can toggle the extension's interface between a harmless decoy, such as a notepad, and a fraudulent wallet import page. This method allows the criminals to activate malicious functionality without submitting new code for review in the Firefox Add-ons store. Because the extensions require minimal permissions, they bypass common user heuristics for identifying risky software.
Full Take
The strongest version of this narrative is a warning about the fragility of browser-based security: the "low-permission" heuristic is a false signal of safety. This case demonstrates a sophisticated decoupling of delivery and execution, where the malicious payload is not the code itself, but a remote instruction.
The pattern here is "dormant infrastructure." By deploying benign shells (sports trackers) that share a backend with malicious ones, attackers build a reservoir of trusted installations. This allows them to pivot a user base from "passive consumer" to "victim" instantaneously via a server-side switch, bypassing the gatekeeping of app store reviews.
The root cause is the inherent trust model of browser extensions, which often treats a lack of requested permissions as a proxy for safety. This echoes the historical evolution of malware, moving from static payloads to dynamic, command-and-control (C2) driven behavior.
For human agency, this creates a "trust paradox." Users are encouraged to limit permissions to stay safe, yet in this instance, limited permissions served as a camouflage. The benefit goes to the attacker who can scale their reach without triggering automated red flags. The second-order consequence is a further erosion of trust in legitimate ecosystem marketplaces.
Bridge Questions:
1. If "minimal permissions" is no longer a reliable safety metric, what objective technical markers should users look for instead?
2. How does the use of legitimate cloud services like Supabase complicate the ability of browser vendors to blacklist malicious infrastructure?
Counterstrike Scan:
A coordinated influence campaign would use this narrative to drive users toward a specific "secure" alternative browser or a paid security suite by amplifying fear. The actual content remains a descriptive warning based on researcher findings without a commercial call to action.
Patterns detected: none