Researchers have identified more than 70 Firefox extensions that steal cryptocurrency wallet seed phrases or password details. The campaign has been running under the radar since at least March 2026.

If you think that by adding an extension to your browser you’re simply managing your cryptocurrency wallet or conveniently tracking sports results, think again. You might also be losing your credentials – and money – especially if you’re using Firefox.

Indeed, researchers at cybersecurity firm Socket have detected dozens of malicious Firefox add-ons designed to steal crypto wallet seed phrases or password details.

Mimicking the OKX crypto exchange

Forty extensions steal wallet secrets or credentials, and 37 are deceptive sports-score shells.

The latter are harmless-looking add-ons that display real-time sports scores to trick users and app stores into trusting them before they are updated to become dangerous cryptocurrency-stealing malware.

In its blog post, the Socket Threat Research team said it was “tracking 77 Firefox extension identities linked through code reuse, cloned extensions, deceptive marketplace descriptions, author-selected add-on ID patterns and domain-like suffixes, cryptocurrency-wallet impersonation, and version histories showing extension repurposing.”

The campaign, dubbed the “Offside Wallet Theft Factory,” has been running under the radar since at least March 2026.

One malicious extension, for example, is called “0KX WEB3” and mimics the OKX crypto exchange by using a zero instead of the letter “O.” In fact, there’s no wallet code inside it.

Instead, the packaged extension combines:

• A functional local notepad used as cover
• A hardcoded Supabase project URL and anonymous API key
• A remotely configurable URL loader
• Logic that loads the supplied URL in the extension popup and opens it separately after installation or update

The extension “is therefore better classified as a remote-controlled phishing delivery extension than a conventional infostealer,” said the researchers.

Whenever a victim opens the extension, it queries the public_notes table in its embedded Supabase project and retrieves the latest content value. Supabase is a legitimate cloud platform – the threat actors abuse a specific project as a remote controller.

Eventually, victims are shown a convincing page inviting them to import their wallet. Users who enter their recovery phrase then hand it straight to the attackers.

Mozilla responds swiftly

Extension-level analysis of 77 add-ons confirmed 40 Firefox extensions as malicious, Socket said.

The other 37 extensions contain deceptive sports-score implementations spanning football, basketball, NBA, and hockey, sharing a hardcoded credential for legitimate API-Sports services while advertising unrelated functions such as password generation, dark mode, VPN access, currency conversion, screenshot capture, and note-taking.

Their cyber pros reported their findings to Mozilla, and, to their credit, Mozilla’s Add-ons Operations team responded swiftly.

Mozilla removed and blocklisted the fraudulent extensions from the official Firefox Add-ons Store. In fact, last year, Mozilla introduced a security mechanism tailored for the Firefox Add-on Portal to prevent future waves of fake crypto wallets.

“Even short-lived cryptocurrency wallet extensions can cause immediate and irreversible financial harm once victims expose recovery phrases or private keys,” said Socket.

“Our Firefox ecosystem coverage complements Mozilla’s protections by identifying related extensions, infrastructure, code reuse, version repurposing, and publishing patterns across the broader campaign.”

Browser extensions have long been used as a place to install malware. In April alone, dozens of extensions on the Chrome Web Store were found to contain malware controlled by a single operator.

Bad news? Researchers say – and have demonstrated – that any browser extension (a price tracker, adblocker, or AI chatbot) can turn malicious overnight and secretly install malware.