40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets

Aug 20, 2026

A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, TronLink, and other Web3 products.

According to the Socket Threat Research team, the extensions are part of a broader set of 77 browser add-ons that share source code and infrastructure overlaps. The campaign, dubbed Offside Wallet Theft Factory, is believed to

Get Free Report & Network Analysis

Please check your email for the free report.