A recent investigation has uncovered a concerning campaign involving dozens of fake Firefox wallet extensions linked to crypto-stealing malware. This campaign, which ran from March 9 to August 3, 2026, identified 77 related Firefox extension identities. Notably, 40 of these extensions were found to be malicious, posing a significant threat to users’ cryptocurrency wallets.
The fake Firefox wallet extensions in question display sophisticated deceptive methods. A total of 40 of these extensions are specifically designed to steal wallet secrets and user credentials. Another 37 extensions masquerade as unrelated tools, such as those displaying sports scores, to appear legitimate. Furthermore, nine extensions initially functioned as score apps but were later updated to engage in wallet malware activities.
The malicious extensions impersonate well-known wallet brands, including OKX, Rabby Wallet, and TronLink, tricking users into believing they are interacting with genuine products. Many of these extensions present a convincing wallet interface, encouraging users to import existing wallets, which compromises their private keys and recovery phrases. Some extensions, particularly the modified builds of Rabby Wallet, engage in data exfiltration by sending stored account information to external servers. Additionally, five extensions have been identified for capturing saved credentials and clipboard contents, further endangering users’ security.
Users of the fake Firefox wallet extensions face significant security risks, primarily involving the theft of critical wallet information. If a user enters a recovery phrase or private key into these extensions, it should be considered permanently compromised, and the immediate transfer of funds to a new wallet is highly advised. Simply uninstalling these malicious extensions does not revoke any sensitive information already transmitted to attackers.
A specific risk is posed by a counterfeit OKX wallet extension, which requested only two permissions—storage and tabs—demonstrating minimal user impact while still engaging in data theft. As a precaution, users should remain vigilant against extensions with suspiciously low permissions and verify the legitimacy of any extension simulating popular wallets.
The campaign involving fake Firefox wallet extensions, named the Offside Wallet Theft Factory by Socket Threat Research, showcased a significant security vulnerability with broader implications. Even as of August 25, 2026, several of these dangerous extensions were still active, highlighting ongoing risks for users. In a related incident, a Chrome extension was exposed for siphoning fees from Solana traders over an extended period before being detected. This underscores the persistent threat of malicious extensions across different platforms, emphasizing the need for vigilant security practices and careful monitoring of browser add-ons and extensions.
The report documented dozens of fake Firefox wallet extensions that were connected to crypto-stealing malware. Many of the extensions were designed to steal wallet secrets and credentials, and several were still live as of August 25, 2026. The persistence of active malicious extensions on that date indicates the ongoing nature of these threats to users of browser-based wallets.
