Socket: "Offside Wallet Theft Factory"

What it is

Socket's Threat Research team's report on "Offside Wallet Theft Factory," a Firefox extension campaign of 77 linked identities. 40 are confirmed malicious wallet/credential stealers; 37 are deceptive sports-score "shell" extensions. The report's value beyond the summary is the breakdown of the 40 malicious extensions into behavioral classes, concrete indicators, and the linking evidence.

How it works

The 40 confirmed malicious extensions split into distinct payload types:

• 7 use threat-actor-controlled Supabase projects as remote switches for phishing content.
• 15 capture recovery phrases/private keys/wallet secrets and exfiltrate via Cloudflare Workers.
• 13 are modified Rabby Wallet builds that exfiltrate serialized keyrings before local encryption.
• 5 steal credentials and clipboard data through hardcoded C2.

The walkthrough case, 0KX WEB3 (name uses a zero for the "O"), contains no wallet code at all — only a local notepad as cover, a hardcoded Supabase URL + anon key, and a URL loader. On open, it queries the public_notes table, retrieves the latest content value (observed: hxxps://portal-web3-extension-welcome[.]pages[.]dev/home), and loads that phishing page in the popup and a separate window after install/update. This is remote-controlled phishing delivery, not a conventional infostealer.

The 37 shells span football/basketball/NBA/hockey and share one hardcoded API-Sports credential, while advertising unrelated features (password generator, dark mode, VPN, currency conversion, screenshots, notes). Nine of the confirmed-malicious IDs previously ran sports shells before being repurposed under the same stable Firefox ID into wallet malware.

Preconditions / Affected

Firefox users who install these extensions. The Rabby-clone variant is the sharpest risk: it captures keyrings pre-encryption, so even a correctly-used wallet leaks. Some extensions were still live when reported.

What to do

• Hunt for extensions that impersonate OKX, Rabby, TronLink, or other Web3 wallets, and for names using homoglyph substitution (zero-for-O).
• Flag extensions embedding Supabase project URLs/anon keys, Cloudflare Workers exfil endpoints, or the shared API-Sports credential.
• Treat a stable Firefox add-on ID whose version history transitions from utility/sports shell → wallet functionality as a strong repurposing signal.
• Report live instances to Mozilla Add-ons Operations.
• Assume any wallet whose recovery phrase or private key touched these extensions is compromised — harm is immediate and irreversible.

Caveats

Socket states the 37 shells' analyzed builds contain no confirmed stealing payload; intent is inferred from deceptive functionality, shared artifacts, and version histories. Attribution is unresolved — the evidence does not establish a single actor controls all extensions; it indicates a common pipeline or closely related actors. Mozilla signing records cover only the original 59 analyzed versions (March 9–August 3, peaking April and late July).