Forty fake Firefox wallet extensions steal seed phrases and private keys

Researchers at Socket found 40 malicious Firefox extensions, part of a wider set of 77, that impersonate cryptocurrency wallets like OKX, Rabby, and TronLink to steal users' funds. Dubbed the Offside Wallet Theft Factory and active since March, the campaign uses lookalike names with subtle character swaps, cloned wallet code, and reused extension identities. Some variants capture recovery phrases as a user sets up or imports a wallet; others copy the wallet's keyring before it is encrypted locally, so on-device encryption offers no protection. Stolen data goes out through Cloudflare Workers, attacker databases, and hardcoded servers. Removing an extension after theft does not secure the wallet, so victims must move funds.

Check

Warn users to install wallet extensions only from verified publishers and to check for lookalike names, and if a fake wallet extension was installed, move funds to a new wallet immediately.

Affected

Firefox users who installed a fake wallet extension impersonating brands like OKX, Rabby, or TronLink; the extensions steal recovery phrases and private keys, in some cases capturing keyrings before local encryption applies.

Fix

Vet browser extensions and publishers carefully, since a stated purpose and modest permissions do not prove safety, and treat any wallet touched by a malicious extension as compromised.