Listen to this Post
A Dangerous New Chapter in Browser Security
Browser extensions are supposed to make the web more useful. They can manage passwords, display sports scores, take notes, connect users to cryptocurrency wallets, or add convenient features to everyday browsing. But every extension also creates another layer of software running inside a trusted environment.
That trust is exactly what cybercriminals are exploiting.
Security researchers at Socket have uncovered a coordinated campaign involving 77 Firefox extension identities, including 40 extensions confirmed to contain wallet- or credential-stealing functionality. The researchers have provisionally named the operation “Offside Wallet Theft Factory.” The activity appears to have been underway since at least March 2026 and continued into August.
The most disturbing part is not simply the number of malicious extensions. It is the way the attackers designed them to look ordinary, harmless, and sometimes even useful until the moment they were ready to steal.
The Extension Store Became Part of the Attack Surface
The campaign demonstrates a broader problem with modern browser security: users often assume that software distributed through an official extension marketplace has already passed a meaningful security test.
That assumption can be dangerous.
Socket found extensions impersonating legitimate Web3 products including OKX, Rabby Wallet, and TronLink, while other extensions were disguised as unrelated utilities. Some appeared to offer note-taking, VPN, password-generation, theme, or sports-score functionality.
The attackers did not need every extension to immediately behave like malware. Instead, they built an ecosystem in which seemingly harmless software could serve as camouflage, evolve through updates, or share code and infrastructure with more obviously malicious packages.
The “0KX WEB3” Trick Shows How Simple Deception Can Work
One of the clearest examples is an extension called “0KX WEB3.”
The name is deliberately deceptive. The first character is a zero rather than the letter “O,” creating a visual resemblance to the legitimate OKX cryptocurrency brand.
At first glance, a user searching for a wallet-related extension could easily interpret the name as an authentic Web3 product.
The extension’s own description reportedly claimed that it collected no data. Yet Socket’s analysis found that the package did not contain a genuine wallet implementation. Instead, it used a remotely controlled mechanism capable of changing what the user saw.
The Notepad Was the Disguise
The most clever element was the use of a harmless-looking interface.
Rather than immediately presenting a wallet-import screen, the extension could display something resembling a simple notepad or other benign functionality.
That makes the extension considerably less suspicious.
A user might install it, open it once, see nothing alarming, and forget about it. Meanwhile, the extension could contact an attacker-controlled backend.
The malicious behavior could then be activated remotely.
Supabase Became the Remote Switch
The attackers used Supabase, a legitimate cloud platform, as part of the remote-control architecture in several extensions.
This distinction is important: Supabase itself is not the malware. The attackers abused legitimate infrastructure to control malicious software.
Socket found seven confirmed malicious extensions using a similar remote-loader architecture. The extensions could query attacker-controlled Supabase projects and retrieve instructions determining what content should be displayed.
That means criminals did not necessarily need to publish another Firefox extension update when they wanted to change the attack.
They could alter the remote configuration.
The Attack Could Change Without a New Extension Update
This is one of the most important lessons from the campaign.
Traditional malicious-extension detection often focuses on the code shipped inside the package. But when an extension retrieves instructions or content from remote infrastructure, its behavior can change after installation.
A seemingly boring extension installed weeks earlier could suddenly begin displaying a malicious wallet page.
The attacker effectively separates the delivery mechanism from the payload.
That makes the operation harder to detect and gives criminals greater flexibility.
The Fake Wallet Page Is Where the Theft Begins
Once the malicious configuration is activated, the extension can display a convincing Web3 interface designed to persuade victims to import an existing wallet.
The victim may see familiar concepts such as “Create Wallet” or “Import Wallet.”
Nothing about the page necessarily screams malware.
The dangerous moment arrives when the user enters a recovery phrase or private key.
A cryptocurrency recovery phrase is not an ordinary password. It can represent the master credential needed to recover control of a wallet and its assets.
Once a victim voluntarily types that information into an attacker-controlled interface, the attacker may be able to reconstruct the wallet elsewhere.
A Recovery Phrase Should Never Be Given to a Browser Extension
This campaign reinforces a fundamental cryptocurrency security rule.
A legitimate wallet may ask a user to enter a recovery phrase during a legitimate recovery process, but users must be extremely careful about where that request originates.
An extension that suddenly asks for a 12-word or 24-word recovery phrase should be treated as a high-risk event, particularly if the user did not deliberately initiate wallet recovery.
The safest assumption is simple:
Anyone who obtains your recovery phrase may be able to control the wallet associated with it.
Minimal Permissions Do Not Mean Minimal Risk
Another particularly valuable lesson from the investigation concerns extension permissions.
Users frequently judge browser extensions by the permissions they request.
That is useful, but it is not enough.
Some of the extensions examined by Socket could perform their theft without requiring a long list of obviously alarming permissions. In the remote-phishing model, the attacker could simply persuade the victim to enter sensitive information into a malicious interface.
The browser permissions therefore tell only part of the story.
77 Extensions Were Connected to the Same Broader Operation
Socket ultimately identified 77 linked Firefox extension identities.
Of those:
40 were confirmed malicious.
37 were deceptive sports-score shells.
The 37 sports-related extensions did not contain confirmed wallet or credential theft in the analyzed builds. However, researchers found extensive links through shared code, publishing artifacts, infrastructure, and version histories.
That distinction matters.
Calling all 77 extensions directly malicious would overstate the evidence. But dismissing the 37 suspicious extensions simply because their analyzed versions lacked confirmed theft functionality would also miss the larger picture.
The Sports Scores Were More Than a Strange Coincidence
The sports-score component is what makes this campaign particularly interesting.
The 37 extensions appeared to provide sports-related functionality involving football, basketball, NBA, and hockey.
Yet their advertised features could include completely unrelated capabilities such as VPN access, password generation, dark mode, currency conversion, screenshots, or note-taking.
Socket found shared sports-score implementations and a common API-Sports credential among numerous extensions.
That suggests the attackers were not necessarily building each extension independently.
They were operating more like a production pipeline.
The “Factory” Name Is More Than a Catchy Label
The term Offside Wallet Theft Factory reflects the researchers’ observation that the campaign appeared to use repeatable templates, shared infrastructure, reused code, and extension identities that could be repurposed.
This is fundamentally different from a lone developer publishing one malicious extension.
The evidence points toward an industrialized approach.
Build a shell.
Publish it.
Allow it to establish credibility.
Repurpose or update it.
Connect it to theft infrastructure.
Repeat.
That is the frightening efficiency behind modern browser-based attacks.
Some Extensions Changed Their Purpose Over Time
Socket found historical evidence showing that nine confirmed malicious identities had previously used sports-score shells before later versions were repurposed into wallet-stealing extensions.
This is an especially important discovery.
A user could have installed an extension because it appeared to be a harmless utility. Months later, the same extension identity could have been transformed into something fundamentally different.
The
The Attackers Also Used Cloudflare Workers
The campaign was not limited to Supabase.
Socket identified 15 extensions that captured recovery phrases, private keys, or other wallet secrets and transmitted them through attacker-controlled Cloudflare Workers.
Again, Cloudflare Workers itself is a legitimate service.
The problem is how attackers use legitimate infrastructure.
This is a recurring cybersecurity pattern: criminals increasingly hide malicious operations inside services that security teams and ordinary users already recognize as normal.
Modified Wallet Code Created an Even More Dangerous Threat
Some extensions went beyond phishing.
Socket identified a cluster of extensions containing modified Rabby Wallet code.
In these cases, victims could potentially interact with what appeared to be a functioning wallet while malicious code quietly intercepted sensitive wallet information.
That is more sophisticated than simply creating an obvious fake login page.
The victim may believe everything is working correctly.
Credential Theft Expanded the Campaign Beyond Cryptocurrency
Five additional Firefox extensions were found collecting credentials and clipboard information through hardcoded command-and-control infrastructure.
This is important because it shows that the campaign was not exclusively about cryptocurrency.
Browser extensions can potentially observe or manipulate sensitive information available to them through their functionality and permissions.
Clipboard data is particularly interesting because users frequently copy passwords, wallet addresses, authentication codes, API keys, and other sensitive information without thinking about what applications might be able to access it.
The Browser Is Becoming a Security Boundary
For years, people have treated browser extensions as small accessories.
That mindset is outdated.
A modern browser extension can interact with webpages, browser storage, tabs, network requests, clipboard data, authentication workflows, and other sensitive resources depending on its permissions and architecture.
In other words, an extension should be treated more like installed software than like a harmless browser theme.
The Cryptocurrency Angle Makes the Consequences Worse
Credential theft can lead to account compromise.
Wallet theft can lead directly to irreversible financial loss.
If attackers obtain a cryptocurrency recovery phrase and transfer the assets, recovering the money may be extremely difficult or impossible.
There is no conventional bank transaction reversal mechanism that guarantees a stolen blockchain transaction can simply be undone.
That makes wallet-stealing extensions particularly dangerous.
Removing the Extension May Not Be Enough
If a victim entered a recovery phrase into one of these malicious extensions, uninstalling the extension does not magically make the phrase secret again.
The phrase may already have been transmitted.
The correct response is therefore fundamentally different from dealing with an ordinary unwanted browser extension.
If a recovery phrase or private key has been exposed, the associated wallet should be considered compromised and assets should be moved to a newly generated, trusted wallet using a clean environment.
The Bigger Problem Is Trust
The most significant lesson from this incident is not “watch out for Firefox extensions.”
It is watch out for misplaced trust.
A familiar logo can be copied.
A convincing description can be fabricated.
A five-star rating can be manipulated.
A legitimate cloud provider can be abused.
A previously harmless extension can be repurposed.
Even an official marketplace can contain malicious software before researchers or platform security teams identify and remove it.
Browser Security Requires Continuous Verification
The old model was simple:
Install an extension once and forget about it.
That model no longer works.
Users should periodically review installed extensions and remove anything they no longer need.
They should also pay attention to unexpected updates, sudden changes in functionality, new permission requests, suspicious publisher names, cloned branding, and extensions that appear unrelated to their stated purpose.
Cryptocurrency Users Need an Extra Layer of Discipline
Anyone managing cryptocurrency through a browser should be especially conservative.
Wallet extensions should be obtained through verified official channels.
The publisher identity should be checked carefully.
The extension name should be compared against the legitimate project’s official website.
Small spelling differences, unusual characters, strange domains, and suspiciously generic descriptions should be treated as warning signs.
And most importantly, a recovery phrase should never be entered simply because an extension asks for it.
What Makes This Campaign So Effective
The attackers did not rely on one trick.
They combined multiple psychological and technical techniques.
They used recognizable brands.
They created harmless-looking utilities.
They reused software templates.
They leveraged legitimate cloud services.
They maintained remote control.
They repurposed extension identities.
They blended malicious packages with deceptive shells.
And they waited for users to provide the most valuable information themselves.
That combination makes the campaign much more dangerous than a simple piece of malware.
Deep Analysis: How the Offside Wallet Theft Factory Works
1. The Attack Begins With Trust
The attacker first needs the victim to trust the extension enough to install it.
2. Familiar Branding Reduces Suspicion
Imitating recognizable Web3 products gives the malicious software an immediate appearance of legitimacy.
3. Utility Extensions Expand the Victim Pool
A sports tracker, notepad, password generator, or theme can attract users who are not even looking for cryptocurrency software.
4. The Extension Can Remain Quiet
A malicious extension does not necessarily need to attack immediately after installation.
5. Remote Configuration Creates Flexibility
The Supabase-controlled architecture allows behavior to be changed without necessarily distributing a completely new extension package.
6. Legitimate Infrastructure Provides Cover
Using services such as Supabase and Cloudflare Workers can make malicious infrastructure look less suspicious than a dedicated criminal server.
- Phishing Turns the Victim Into the Final Link
Instead of exploiting a complicated browser vulnerability, the attackers can simply persuade the victim to provide the recovery phrase.
8. Cryptocurrency Makes the Target Extremely Valuable
A single successful wallet compromise can potentially produce a much larger payoff than stealing an ordinary online account.
9. Code Reuse Makes Scaling Easier
Once an attacker has developed a functional theft mechanism, it can be copied into many extension identities.
10. Rebranding Makes Detection Harder
Changing names, descriptions, icons, and extension identities can make related packages appear unrelated to users.
11. Version History Reveals the Real Story
An
- The Sports Shell Is a Clever Distraction
A sports-score application creates a plausible reason for network activity while hiding its connection to unrelated functionality.
13. Small Permissions Can Create False Confidence
Users may see limited permissions and conclude that an extension cannot be dangerous.
That conclusion is not reliable.
14. The Human Element Remains Critical
The attackers ultimately depend on human trust.
A convincing interface can defeat technical protections if a user voluntarily enters a secret.
15. Fake Wallet Interfaces Are Extremely Dangerous
A malicious wallet does not need to steal funds directly.
It only needs to steal the credentials that control them.
16. Clipboard Theft Adds Another Layer
Users routinely copy sensitive information, making clipboard access potentially valuable to attackers.
17. Legitimate Services Are Becoming Attack Infrastructure
Cloud platforms are increasingly attractive to criminals because they provide scalable infrastructure without requiring attackers to operate every component themselves.
- Marketplace Approval Is Not a Permanent Guarantee
Even if an extension passes an initial review, later updates or remote content can change its risk profile.
19. Static Analysis Has Limits
An extension may appear relatively harmless when examined in isolation if its most dangerous behavior is remotely controlled.
20. Dynamic Behavior Matters
Security teams need to understand what an extension actually does during execution, not just what its manifest claims.
21. Publishers Matter as Much as Permissions
A suspicious publisher history can be a stronger warning than the number of permissions requested.
22. Branding Should Never Be Trusted Alone
Logos and names are easy to reproduce.
- The Official Website Is the Better Starting Point
Users should navigate to a wallet
24. Search Results Can Be Dangerous
Searching an extension marketplace for a famous wallet name can produce clones that exploit small visual differences.
- Crypto Users Have Less Room for Mistakes
A compromised social-media account can often be recovered.
A stolen recovery phrase may permanently expose the associated funds.
26. Extension Updates Deserve Attention
An extension that suddenly changes purpose should be treated as suspicious.
27. Old Extensions Can Become New Threats
The campaign demonstrates why “I installed this months ago” does not automatically mean “this extension is safe.”
- Shared Infrastructure Is a Powerful Investigation Tool
Researchers can connect seemingly unrelated packages through infrastructure, code, identifiers, and historical versions.
29. The Campaign Shows Industrialization
The use of templates and repeatable publishing techniques suggests that malicious extensions can be produced at scale.
30. Attackers Are Optimizing for Conversion
The goal is not merely to infect as many computers as possible.
The goal is to maximize the percentage of victims who eventually surrender valuable information.
31. The Best Malware May Look Boring
A simple notepad or sports-score extension may be less suspicious than an obvious “free crypto wallet.”
32. Social Engineering and Malware Are Converging
Modern browser threats increasingly combine malicious code with psychological manipulation.
33. The Browser Is a High-Value Target
The browser sits between users and many of their most sensitive online services.
34. Wallet Security Must Include the Browser
Protecting a hardware wallet or using strong passwords is not enough if a malicious browser extension can intercept sensitive operations.
35. Extension Hygiene Should Become Routine
Users should regularly audit what is installed and remove unnecessary software.
36. Developers Also Have a Responsibility
Extension developers should minimize dependencies, protect backend infrastructure, monitor unexpected changes, and provide transparent security practices.
37. Security Teams Need Cross-Version Analysis
Looking at only the newest version can miss the transition from benign software to malicious software.
38. Detection Needs Ecosystem-Level Thinking
One malicious extension may look like an isolated incident.
Dozens sharing code, infrastructure, and publishing behavior tell a very different story.
39. “No Data Collection” Claims Need Verification
Marketing language cannot substitute for technical analysis.
- The Real Warning Is Bigger Than Firefox
The underlying technique can be adapted to other browsers, marketplaces, software ecosystems, and cloud services.
That is why the Offside Wallet Theft Factory should be viewed as a warning about the future of software supply-chain attacks, not simply another list of dangerous Firefox add-ons.
What Undercode Say:
The Real Innovation Is the Business Model
What stands out most to Undercode is not the fake wallet itself. Fake wallets have existed for years. The more important development is the apparent production-line approach behind the campaign.
Attackers Are Building Reusable Systems
Once criminals develop a working template for stealing recovery phrases, they can repeatedly repackage that technology under different names, icons, and descriptions.
Remote Control Changes the Equation
The use of remote infrastructure means an extension can behave differently over time without requiring the attacker to completely rebuild the campaign.
Trust Is Becoming the Primary Exploit
The attackers do not necessarily need a sophisticated Firefox zero-day. They need a convincing enough interface to make a person surrender the information that protects their assets.
Official Stores Are Not Perfect Security Barriers
The presence of an extension inside an official marketplace should increase confidence compared with downloading unknown executable software from a random website, but it should never be treated as an absolute security guarantee.
Cryptocurrency Creates a Perfect Target
Crypto wallets concentrate enormous value behind small pieces of information.
A 12-word or 24-word recovery phrase can be more valuable to a criminal than thousands of stolen usernames and passwords.
The Sports-Score Shell Is Particularly Interesting
The sports extensions show how attackers can create software that appears completely disconnected from their eventual objective.
That is a powerful strategy because defenders looking only for obvious wallet terminology may miss it.
The Campaign Also Demonstrates Patience
A criminal does not always need immediate monetization.
An extension can establish itself, accumulate installations, remain quiet, and later become part of an active attack.
Version History Is Now Security Evidence
Users and security teams should increasingly ask not only what an extension does today, but what it did yesterday.
Remote Content Deserves More Scrutiny
An extension that retrieves significant functionality from external servers creates additional risk because the effective behavior is not necessarily contained inside the original package.
Legitimate Cloud Platforms Create Complications
Blocking an entire legitimate cloud service is usually unrealistic.
Security teams instead need to identify the specific malicious projects, endpoints, patterns, and behaviors associated with abuse.
Permissions Are Only One Piece of the Puzzle
An extension asking for fewer permissions can still facilitate phishing or expose secrets through its own interface.
Social Engineering Remains Extremely Powerful
The simplest attack can sometimes outperform the most technically advanced one if the victim believes the screen in front of them.
Wallet Recovery Should Be Treated as a High-Risk Operation
Users should never enter recovery phrases casually, especially into an extension they recently discovered or do not recognize with absolute confidence.
The Damage Can Be Irreversible
Once wallet secrets are stolen and funds are moved, the victim may have few practical options.
The Campaign Shows Why Web3 Security Must Be Layered
Users need trusted wallet software, secure devices, verified installation sources, careful transaction practices, and strong awareness of phishing.
Security Is Not a One-Time Decision
Installing an extension safely today does not guarantee that the same software will remain safe indefinitely.
Extensions Should Be Audited Like Applications
The browser interface makes extensions feel lightweight, but their security implications can be much larger.
The 37 Deceptive Extensions Should Not Be Misrepresented
Undercode considers it important to preserve
But Suspicion Still Matters
Their shared infrastructure, code, publishing artifacts, and historical links make them relevant to the wider investigation.
Attribution Should Remain Conservative
The evidence points toward a common publishing pipeline or closely connected actors, but Socket has not established that one known threat actor controls every extension.
This Is a Supply-Chain Problem
The campaign shows how software that appears unrelated can become part of a broader criminal ecosystem through shared code and infrastructure.
The Next Generation of Attacks Will Be Modular
Criminals increasingly separate loaders, infrastructure, payloads, branding, and monetization.
That Makes Detection Harder
When components can be swapped independently, defenders cannot rely on one static signature.
Security Researchers Need Historical Visibility
Monitoring changes across extension versions can reveal malicious transformations that would otherwise remain hidden.
Users Need Better Verification Habits
Checking the official publisher, legitimate website, extension identity, installation source, and update history can significantly reduce the risk.
Crypto Users Should Be Especially Suspicious
A wallet extension is not comparable to a simple weather widget.
It can become a direct gateway to financial assets.
The Most Valuable Secret Is Often the One You Type
Even sophisticated malware campaigns can ultimately depend on one moment when the victim enters a recovery phrase.
Convenience Creates Risk
Every additional extension installed in a browser increases the amount of software users must trust.
Less Software Can Mean Less Exposure
Removing extensions that are no longer needed is a simple but effective security habit.
The Campaign Should Change How We Think About Extensions
An extension is not merely a browser decoration.
It is software operating inside an environment that users trust with highly sensitive activities.
“It Came From the Store” Is Not Enough
Users should treat marketplace availability as one signal among many rather than as proof of safety.
The Browser Has Become a Financial Endpoint
For cryptocurrency users, the browser can effectively become part of the banking infrastructure.
That Makes Browser Security Financial Security
A malicious extension can potentially turn a routine browser interaction into a direct financial compromise.
The Factory Model Is the Biggest Warning
If this approach proves profitable, criminals have every incentive to repeat it across more browsers, marketplaces, brands, and software categories.
The Industry Needs to Respond
Browser vendors, extension marketplaces, security researchers, wallet developers, and users all have a role in reducing this threat.
Final Undercode Assessment
The Offside Wallet Theft Factory is a warning that modern cybercrime does not always look like malware. Sometimes it looks like a useful browser tool, a sports scoreboard, a wallet, or a simple notepad.
That is precisely what makes this campaign so dangerous.
✅ Socket confirmed that 40 of the 77 linked Firefox extension identities contained malicious wallet- or credential-stealing functionality, while the remaining 37 were identified as deceptive sports-score shells in the analyzed builds.
✅ Socket reported that the campaign had been active since at least March 2026 and used techniques including Supabase-controlled loaders, Cloudflare Workers, modified wallet code, and credential/clipboard theft infrastructure.
❌ It would be inaccurate to describe all 77 extensions as confirmed data-stealing malware. Socket specifically states that the analyzed builds of the 37 sports-score extensions contained no confirmed credential- or wallet-stealing payload, although their links to the wider operation and historical repurposing raised serious concerns.
Prediction
(-1) Browser-extension supply-chain attacks are likely to become more sophisticated as attackers increasingly use remote configuration, legitimate cloud platforms, cloned branding, and modular code to evade detection.
(-1) Cryptocurrency users will remain especially attractive targets because stealing a recovery phrase can provide attackers with direct access to valuable digital assets, while blockchain transactions may be extremely difficult to reverse.
(+1) Security researchers are likely to respond with stronger ecosystem-level monitoring that examines extension code reuse, publisher behavior, version history, infrastructure relationships, and remotely delivered content rather than relying only on permission analysis.
(+1) Users who adopt stricter extension hygiene, verify wallet software through official sources, and treat recovery phrases as secrets that should almost never be entered into unfamiliar interfaces can substantially reduce their exposure to this class of attack.
(+1) The growing attention around malicious extensions should also push browser vendors and marketplace operators toward more continuous monitoring, particularly for extensions whose behavior changes substantially after installation.
▶️ Related Video (68% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bitdefender.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
