Every time you add an extension or plugin to your browser, there’s a risk that you might be doing more than managing your cryptocurrency wallet, generating passwords, taking notes, or tracking sports results. There’s a chance that you have just handed a complete stranger access to your savings. Security researchers at Socket have identified scores of malicious linked Firefox add-ons designed to steal cryptocurrency wallet seed phrases or password details. The campaign, which researchers have dubbed the “Offside Wallet Theft Factory,” has been running under the radar since at least March 2026, and it represents a sophisticated and evolving threat to anyone who manages digital assets through their browser.
The Mechanics of the “Offside Wallet Theft Factory” Campaign
The core of this operation is a network of at least 77 interconnected Firefox add-ons, 40 of which have been confirmed by security experts to steal information. The attackers’ primary target is cryptocurrency wallet seed phrases—the master keys that grant control over digital assets. The campaign’s architects have demonstrated a deep understanding of how to evade detection by building their malicious infrastructure on legitimate cloud services.
One prominent example of a malicious extension is called “0KX WEB3,” which uses a zero rather than the letter “O” in an attempt to mimic the OKX cryptocurrency exchange. This extension, like many others in the network, looks like a wallet app on the surface, but the truth is that there is no wallet code inside it. The developers boldly claim in their listing that the add-on collects “no data,” a statement that is technically true but deeply misleading.
figurefigure
How a Single Database Switch Controls the Attack
Behind the scenes, the malicious extension silently checks a database on Supabase, a legitimate cloud service, every time it is opened. Hackers controlling the database can decide what happens next. By flipping a switch in that database, the attackers can toggle the extension’s behavior. Most of the time, it shows a harmless decoy, like a notepad. But on command, it swaps to a convincing-looking page inviting users to import their wallet.
figurefigure
Victims who enter their recovery phrase there hand it straight to the attackers. Because the switch lives in the database rather than the extension code, criminals never need to push an update through the Firefox Add-ons store to activate it. This is a critical detail that makes the attack particularly dangerous. A standard browser extension store review process might catch malicious code submitted during an update, but it cannot catch behavior that is triggered remotely from a server the attackers control.
The Minimal Permission Paradox: Why Fewer Permissions Don’t Mean Safety
What is so crafty about this design is that the extension itself does very little. It only requires a minimal number of permissions to install. That is a useful reminder to everyone that just because an extension asks for very few permissions does not mean it is automatically safe. The threat model here is inverted: the extension is essentially a remote-control Trojan, and the dangerous payload is delivered from the cloud, not from the add-on’s codebase.
The minimal permission approach helps these extensions slip past automated security scanners and manual reviews. A human reviewer examining “0KX WEB3” might see a convincingly styled wallet interface with a plausible-but-fake privacy policy. They would see no code that exfiltrates data, because the exfiltration code is not there—it is triggered by a command from the Supabase database. The extension only downloads and executes that malicious code when it receives the right signal.
Sports Score Trackers as Trojan Horses
The campaign’s reach extends far beyond the 40 confirmed information-stealing add-ons. The remaining 37 extensions presented themselves as VPNs, password generators, or note-taking tools—but secretly ran code that tracked NBA, hockey, or football scores. Although the researchers did not find that these extensions presently contained malicious code, the fact that they shared code and infrastructure with the info-stealing Firefox extensions raises alarm.
In fact, several of the extensions that have been confirmed to steal cryptocurrency wallet data started as one of the same sports score shells—and only later got “updated” to swap their scoreboard for something that could end up draining a victim’s finances. This points to a deliberate, staged rollout strategy. The attackers first build a base of users with a seemingly innocent and functional add-on. They collect legitimate installs, build positive ratings, and establish trust. Then, when the time is right, they push an update that turns the add-on into a phishing machine.
A Long History of Browser Extension-Based Cryptocurrency Theft
Cybercriminals have used browser add-ons as a route into crypto wallets many times before. The “Offside Wallet Theft Factory” is not an isolated incident but part of a well-established pattern. In 2020, 49 Chrome browser extensions were booted from the Chrome Web Store for their ability to steal passphrases and private keys, propped up with fake five-star reviews to boost their credibility. More recently, over 100 malicious Chrome extensions were caught stealing Google and Telegram data from 20,000 users. In April 2026, fake ChatGPT extensions were found stealing login credentials from unsuspecting users who thought they were accessing the popular AI tool.
The pattern is consistent: cybercriminals have learned that if you dress malware up as something that people want, they can sit back and wait for the riches to roll in. The attackers behind this campaign are simply iterating on proven tactics. By using a backend database to control the malicious payload, they have added a layer of obfuscation that makes detection significantly harder.
What Is a Wallet Seed Phrase and Why Is It So Valuable?
A wallet seed phrase, also called a recovery phrase or mnemonic phrase, is a set of 12, 18, or 24 words that serves as the master key to a cryptocurrency wallet. Unlike a password that can be reset, a seed phrase is the ultimate cryptographic root. Anyone who possesses it can restore the entire wallet on any compatible device and move all funds to their own address. There is no recourse: cryptocurrency transactions are irreversible by design. This makes seed phrases one of the most valuable targets for cybercriminals, and it is why attacks like the “Offside Wallet Theft Factory” focus on tricking users into entering them into fake wallet interfaces.
The Role of Legitimate Services in Cryptocurrency Crime
A notable feature of this campaign is the use of Supabase, a legitimate cloud infrastructure service, to host the command-and-control database. Supabase is an open-source Firebase alternative that provides real-time database and authentication services. The attackers are not exploiting a vulnerability in Supabase itself; they are simply using its service as a tenant. The database is likely registered under false credentials, and the database tables contain commands that the Firefox extensions are programmed to fetch.
This abuse of legitimate cloud services is a growing trend in cybercrime. Services like Supabase, Firebase, AWS, and DigitalOcean are now commonly used by attackers because they are reliable, scalable, and difficult for law enforcement to take down without cooperation from the service provider. The traffic between the extension and the database looks normal, blends in with legitimate traffic, and does not trigger the same alarms that might be raised by a connection to a known malware command-and-control server.
Implications for the Firefox Add-On Ecosystem
This campaign raises serious questions about Mozilla’s add-on review process. While the company has automated scanners and a team of human reviewers, the technical sophistication of the “Offside Wallet Theft Factory” demonstrates that these defenses are not sufficient. The use of a remote database to control malicious behavior means that at the time of submission, the extension appears benign. By the time Mozilla’s review team has signed off, the attackers have not uploaded any malicious code to the store.
The dynamic nature of these threats suggests that the browser extension review model itself needs to evolve. One potential solution is continuous monitoring: not just reviewing the code at submission time, but also monitoring how extensions behave after installation. This could include checking for unexpected network connections to cloud databases, or scanning for code that is loaded dynamically from external sources. However, this approach raises privacy concerns for legitimate extensions that do load remote content for functional purposes.
How to Protect Yourself from Malicious Browser Extensions
The most effective defense against this type of attack is a combination of skepticism, vigilance, and good security hygiene. There are several concrete steps you can take to reduce your risk.
First, make sure to only install extensions from well-known, verified publishers. You should always treat with caution anything that allows others to manage your cryptocurrency from within your browser. The OKX brand is legitimate, but “0KX WEB3” with a zero is not. A simple spelling check can often reveal a malicious impersonator.
Second, understand that a legitimate wallet is not going to ask you to enter your recovery phrase on a webpage. This is one of the most fundamental rules of cryptocurrency security. Your seed phrase is designed to be entered only into the official wallet software itself, during the initial setup or restore process. Any browser extension, app, or website that asks you to paste in your seed phrase is almost certainly a scam. There is no legitimate technical reason for an extension to request this information.
Third, do not decide if you can trust a browser extension purely based upon the permissions it requests. Some of the most dangerous extensions described in this article asked for almost nothing. The attackers in this campaign understood that users have been trained to look at permission requests as a primary safety signal. By minimizing permissions, they create a false sense of security. The real danger lies in what the extension does after it is installed, not what it asks for during installation.
Fourth, review your installed extensions regularly, and remove anything that you do not recognize or that you feel you no longer need. Extensions can be updated post-install to add malicious code. An extension that was perfectly safe when you installed it six months ago might have been sold to a new developer or compromised in the interim. A regular audit of your browser extensions—just like you would audit your bank accounts or credit reports—is a good habit to develop.
Finally, if you do ever enter a recovery phrase into an extension that you now feel uncertain about, consider the wallet compromised. Move your funds to a fresh safe wallet immediately. Simply deleting the suspicious extension may be shutting the barn door after the horse has bolted. Once the attackers have your seed phrase, they can drain your wallet at any time. The only safe course of action is to create a new wallet with a new seed phrase, transfer all funds to it, and never use the old wallet again. This process, while inconvenient, is far less painful than losing your entire cryptocurrency holdings.
The Broader Market and Industry Implications
The “Offside Wallet Theft Factory” campaign is likely not the last of its kind. As cryptocurrency adoption continues to grow, browser extensions will remain an attractive attack vector. The attackers have demonstrated that they can bypass store reviews, use legitimate cloud services, and pivot from seemingly harmless sports trackers to financial drains. This represents a significant threat to the security of browser-based cryptocurrency management.
For the cryptocurrency industry, this campaign underscores the importance of hardware wallets and dedicated wallet software over browser extensions. While browser extensions offer convenience, they also introduce a large attack surface. Hardware wallets, which store private keys on a dedicated physical device that never connects to the internet, are immune to this type of attack. For users who do choose to use browser extensions, the safest approach is to use them only with a hardware wallet connected via USB, so that the private keys never leave the device and the seed phrase is never exposed to the browser.
For browser vendors like Mozilla, this campaign is a call to action. The current review and security model is insufficient for a world where attackers can use remote databases to control malicious behavior. The industry may need to adopt more proactive measures, such as runtime behavior analysis, network traffic monitoring, and threat intelligence sharing across browser ecosystems. The fact that this campaign ran from at least March 2026 until its discovery by Socket suggests that there is a significant gap between the speed at which attackers can operate and the speed at which defenders can identify and remove threats.
As the line between harmless utility and malicious intent blurs within browser extensions, the burden of security falls increasingly on the end user. Understanding the mechanics of these attacks—how they bypass protections, how they use legitimate services, and how they pivot from benign to malicious—is the first step in protecting yourself. The next time you are tempted to install a browser extension that promises to help you manage your crypto, track your sports scores, or generate your passwords, remember that the most dangerous threats are often the ones that look the most harmless.
