Firefox Discovers 40 Malicious Cryptocurrency Wallet Extensions Stealing Mnemonics

A security company, Socket, has discovered a batch of malicious cryptocurrency wallet extensions targeting Firefox users, linked to an attack campaign named "Offside Wallet Theft Factory." Currently, 40 malicious extensions have been confirmed, with activity spanning from March to August 2026. These extensions disguise themselves as well-known Web3 wallets like OKX, Rabby Wallet, and TronLink, luring users into importing existing wallets to steal their mnemonics or private keys. About half of the extensions directly request the input of mnemonics, 13 are modified versions of Rabby that send wallet information to external servers while saving data, and 5 extensions collect saved credentials and clipboard content. Socket also found that at least 9 malicious extensions previously operated as sports score applications, accumulating users before updating to wallet theft code, while another 37 disguised themselves as tools like password generators, VPNs, and currency converters, actually running sports score programs. Socket warns that if users have entered mnemonics or private keys into these extensions, they should immediately transfer their assets to a new wallet, as uninstalling the extensions cannot revoke the information that has already been transmitted.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.