Malicious Firefox Extensions Target Cryptocurrency Wallets in Large-Scale Theft Campaign
A sophisticated campaign, tracked as "Offside Wallet Theft Factory," has been distributing 13 malicious Firefox extensions impersonating the Rabby Wallet to steal cryptocurrency keyring data before local encryption occurs. The operation, active since at least March 2026, involves 77 Firefox extension identities linked through cloned code, reused infrastructure, and deceptive listings.
Key Details of the Attack
- Malicious Extensions: Of the 77 identified extensions, 40 were confirmed malicious, while 37 acted as deceptive sports-score shells (e.g., NBA or football score trackers) that later transitioned into wallet-stealing malware.
- Impersonation Tactics: Attackers used homoglyphs and subtle spelling variations (e.g., RABB-Wallet Web3 & EVM, Rabbit For Desktop) to mimic legitimate Rabby Wallet branding.
- Exfiltration Mechanism: The extensions modified Rabby’s
persistAllKeyrings()function to transmit unencrypted keyring data to attacker-controlled servers via plain HTTP on port 9000, using/hook/webhook paths. Domains involved include gemachriverdale[.]org and e-wl[.]com. - Stealth Techniques: After exfiltration, the extensions allowed normal wallet behavior to continue, minimizing detection.
Broader Campaign Infrastructure
- Staging Model: Some extensions initially appeared as benign utilities (e.g., VPNs, password generators) before being repurposed into malware.
- Additional Threats: The campaign also includes Supabase-controlled phishing loaders, Cloudflare Workers-based key stealers, and credential-harvesting extensions.
- Deceptive Listings: One extension, 0KX WEB3, posed as an OKX wallet while functioning as a phishing delivery mechanism.
Defensive Indicators
Security teams can detect this activity by monitoring:
- Modifications to
persistAllKeyrings() - Outbound cleartext traffic to port 9000
/hook/webhook patterns- Rabby code reuse and homoglyph branding
- Sudden transitions from utility/sports apps to wallet-related code
Mozilla’s records show the campaign’s signing activity spanned March 9 to August 3, 2026, with peaks in April and late July. Users are advised to verify extensions through official wallet provider links, as compromised recovery phrases or private keys should be considered permanently exposed.
Source: https://gbhackers.com/13-malicious-rabby-firefox-extensions/
Mozilla cybersecurity rating report: https://www.rankiteo.com/company/mozilla-corporation
"id": "MOZ1787208871",
"linkid": "mozilla-corporation",
"type": "Cyber Attack",
"date": "3/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'FinTech, Cryptocurrency',
'name': 'Rabby Wallet (Impersonated)',
'type': 'Cryptocurrency Wallet Provider'},
{'industry': 'FinTech, Cryptocurrency',
'name': 'OKX Wallet (Impersonated)',
'type': 'Cryptocurrency Wallet Provider'}],
'attack_vector': 'Malicious Browser Extensions',
'customer_advisories': 'Users are advised to verify extensions through '
'official wallet provider links, as compromised '
'recovery phrases or private keys should be considered '
'permanently exposed.',
'data_breach': {'data_encryption': 'No (data exfiltrated before local '
'encryption)',
'data_exfiltration': 'Yes (via plain HTTP on port 9000 to '
'attacker-controlled servers)',
'personally_identifiable_information': 'Cryptocurrency wallet '
'credentials (recovery '
'phrases, private '
'keys)',
'sensitivity_of_data': 'High (cryptocurrency private keys and '
'recovery phrases)',
'type_of_data_compromised': 'Cryptocurrency keyring data, '
'recovery phrases, private keys'},
'date_detected': '2026-03-01',
'description': "A sophisticated campaign, tracked as 'Offside Wallet Theft "
"Factory,' has been distributing 13 malicious Firefox "
'extensions impersonating the Rabby Wallet to steal '
'cryptocurrency keyring data before local encryption occurs. '
'The operation involves 77 Firefox extension identities linked '
'through cloned code, reused infrastructure, and deceptive '
'listings.',
'impact': {'brand_reputation_impact': 'High (impersonation of legitimate '
'wallet providers like Rabby and OKX)',
'data_compromised': 'Cryptocurrency keyring data, recovery '
'phrases, private keys',
'identity_theft_risk': 'High (exposure of private keys and '
'recovery phrases)',
'operational_impact': 'Potential permanent exposure of compromised '
'recovery phrases or private keys',
'payment_information_risk': 'High (cryptocurrency theft)',
'systems_affected': 'Firefox browser extensions impersonating '
'Rabby Wallet and other cryptocurrency '
'wallets'},
'initial_access_broker': {'entry_point': 'Malicious Firefox extensions',
'high_value_targets': 'Cryptocurrency wallet users'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Users should verify browser extensions through official '
'sources to avoid impersonation attacks. Security teams '
'should monitor for suspicious modifications to '
'wallet-related functions and unusual outbound traffic '
'patterns.',
'motivation': 'Financial Gain (Cryptocurrency Theft)',
'post_incident_analysis': {'corrective_actions': 'Enhanced monitoring for '
'suspicious extensions, user '
'education on verifying '
'extensions, and detection '
'of unusual outbound traffic '
'patterns',
'root_causes': 'Deceptive extension listings, '
'homoglyph impersonation, and '
'modification of wallet functions '
'to exfiltrate unencrypted data'},
'recommendations': ['Verify extensions through official wallet provider links',
'Monitor for modifications to `persistAllKeyrings()` '
'function',
'Detect outbound cleartext traffic to port 9000 and '
'`/hook/` webhook patterns',
'Check for Rabby code reuse and homoglyph branding in '
'extensions',
'Be cautious of extensions transitioning from benign '
'utilities to wallet-related functionality'],
'references': [{'source': 'Cyber Incident Description'}],
'response': {'enhanced_monitoring': 'Monitoring for modifications to '
'`persistAllKeyrings()`, outbound '
'cleartext traffic to port 9000, and '
'`/hook/` webhook patterns',
'remediation_measures': 'Users advised to verify extensions '
'through official wallet provider links'},
'threat_actor': 'Offside Wallet Theft Factory',
'title': 'Malicious Firefox Extensions Target Cryptocurrency Wallets in '
'Large-Scale Theft Campaign',
'type': 'Malware Distribution',
'vulnerability_exploited': "Modification of Rabby Wallet's "
'`persistAllKeyrings()` function to exfiltrate '
'unencrypted keyring data'}