Critical Firefox Extensions Exploit Cloudflare to Steal Crypto Wallets
Key Takeaways A sophisticated campaign involving 77 malicious Firefox extensions has been actively stealing cryptocurrency wallet data, login credentials, and clipboard contents since at least March...
Key Takeaways
- A sophisticated campaign involving 77 malicious Firefox extensions has been actively stealing cryptocurrency wallet data, login credentials, and clipboard contents since at least March 2026.
- The attackers leverage Cloudflare Workers and Supabase projects as command-and-control infrastructure to exfiltrate sensitive user data, including recovery phrases and private keys.
- Many malicious extensions masquerade as legitimate crypto wallets, themes, or simple browser utilities, often displaying decoy interfaces or loading remote phishing pages.
- Users are advised to immediately remove any listed suspicious extensions, verify publishers, and never enter recovery phrases or private keys into browser pop-ups or unverified webpages.
Firefox users are currently under attack from a widespread campaign involving numerous malicious add-ons designed to steal cryptocurrency wallet information, login details, and clipboard data. These extensions, which often appear as legitimate crypto wallets, innocuous themes, or basic browser tools, pose a significant threat to digital assets and online accounts.
Table Of Content
The operation, identified by researchers at Socket.dev and dubbed “Offside Wallet Theft Factory,” has been active since at least March 2026. It encompasses 77 distinct Firefox extension identities, comprising 40 confirmed malicious add-ons and 37 deceptive sports-score applications used to blend into the Firefox Add-ons marketplace. Socket.dev said in a report that the group employs a repeatable publishing strategy, evidenced by reused code, shared infrastructure, misleading descriptions, and updates to older extension identities.
This campaign highlights a critical security concern: the stated purpose of an add-on or its requested permissions are not sufficient indicators of trustworthiness. Many malicious samples used seemingly harmless applications, such as notepads or sports score trackers, as a facade while the actual data theft occurred either within the extension’s code or on a remote webpage.
15 Malicious Firefox Extensions Abuse Cloudflare Workers
A significant portion of the malicious extensions—15 in total—contained embedded fake wallet interfaces or directly modified legitimate wallet code within their signed packages. These extensions were designed to capture critical information like recovery phrases and private keys during the wallet creation or import process. This stolen data was then covertly transmitted to attacker-controlled deployments hosted on Cloudflare Workers, mirroring previous Cloudflare Workers abuse cases where legitimate cloud services are weaponized for malicious data exfiltration.
Several of these variants either copied or altered Rabby-derived wallet code, yet presented themselves under unrelated, theme-like names. These implants specifically targeted and intercepted new or imported 12-word and 24-word recovery phrases. Other malicious extensions displayed fraudulent import pages for wallets such as Portal, OKX, or generic Web3 services, relying on users to manually input their secret phrases rather than attempting to extract them directly from the browser’s local storage. A recovery phrase is sufficient to restore a wallet on any device, meaning that once compromised, deleting the extension offers no protection for the stolen funds.
Thirteen additional Rabby-style modified extensions adopted a more stealthy approach. Before the wallet software could encrypt and store its keyring data locally, the altered code would transmit the serialized keyrings to hardcoded HTTP servers. This pre-encryption exfiltration rendered local encryption mechanisms ineffective against the theft of this crucial information.
Repurposed Add-Ons Expand the Campaign
Seven extensions utilized a remote-control architecture built around attacker-managed Supabase projects. For instance, an extension named 0KX WEB3, despite advertising wallet functionalities, contained no actual wallet code. Instead, it loaded a remote website within its popup, displayed a decoy notepad when idle, and automatically opened the malicious page upon installation or update. This dynamic approach complicates detection, as operators can switch an extension between benign and phishing content without requiring a new publication.
This method underscores the lessons learned from recent extension supply chain attacks, where seemingly benign tools can transform into data stealers through subsequent updates. Another five extensions were found to collect credentials and clipboard contents, transmitting them to a hardcoded command-and-control server. Clipboard theft is particularly dangerous as it can expose a wide range of sensitive data, including copied passwords, authentication tokens, wallet addresses, and private keys.
Investigators also discovered 37 add-ons that posed as unrelated utilities but were merely repackaged sports-score applications. Notably, nine malicious identities had earlier versions that were legitimate sports-score apps before being repurposed into wallet stealers. This tactic helps the attackers evade detection and build a deceptive reputation over time.
The indicators of compromise (IoCs) for this campaign are extensive, covering Firefox extension IDs and SHA-256 hashes, Supabase project URLs, Cloudflare Worker endpoints, various request patterns, and a C2 IP address. These details are crucial for defenders to identify and mitigate threats. For a comprehensive list, refer to the table below. Note that IP addresses and domains are intentionally defanged to prevent accidental resolution; they should only be re-fanged within controlled threat intelligence platforms.
| Type | Indicator | Description |
|---|---|---|
| Firefox extension / SHA-256 | bliss-heaven@webbrol[.]com08b7b064fa9a41b06774315d944ffddff705ab727222a0c3bcac64a77553bf2f |
Safe-Themes – Browser Extension, version 8.12.13 |
| Firefox extension / SHA-256 | bold-page-vault@addonslab[.]example4d0912d575087dab5f468214a2fd259bc386472a8b2b93b6e2441cde4bd941cb |
Portal, version 7.9.17 |
| Firefox extension / SHA-256 | bright-save-feed@tabtools[.]org26427220b9965e22deca0e617657c2c65b78f750183355d1265c147818367bd74 |
Rabbit For Desktop, version 8.20.10 |
| Firefox extension / SHA-256 | chiro-di-red@tools[.]com252119fc48ad93b0c930d7a62fb49420cf8986716539e4e9d4d5c1bad700d4355 |
Sady-Theme – Browser Extension, version 8.12.13 |
| Firefox extension / SHA-256 | chiro-redok@webtools[.]com3c0f0413ca6326bd0107d532aec4daad7feec663d072f7c992682fb702b64cce |
Safe-Theme – Browser Extension, version 8.12.13 |
| Firefox extension / SHA-256 | cool-block-gear@protools[.]com31dc33e75aa2a9e64eac98467c5a516201e208d68ffe10d07800350ce1a44197 |
tab-W – Browser Extension, version 8.12.10 |
| Firefox extension / SHA-256 | fast-akap-safe@browsertools[.]com9c6f173418245a953d5fc3e9ec69f09b7aee8563127042a995ad172de9cdb88d |
Portal, version 7.9.17 |
| Firefox extension / SHA-256 | fast-map-safe@linktools[.]coeeb1969d0c8b250976ec220f40236ddd7eb6863556379d17e1dd4078b5531751 |
Portal, version 7.9.17 |
| Firefox extension / SHA-256 | flex-clock-dash@extrakits[.]com6408b6a2c4000e74cde94d3ce31ada5e024d80782199e8010d6ef482686e687b |
Rabby wallet impersonator, version 2.4.9 |
| Firefox extension / SHA-256 | free-note-bolt@webtools[.]co8590d1a22fdf42a363fe41fe6dc2cb03e616cc6d413f63d2ade9fd3ab54f1c831 |
Rabb-Walet CryptoPortfolio, version 88.10.10 |
| Firefox extension / SHA-256 | green-fam-heav@browsertool[.]comedcdbcdbea729fb11cbb0a353c3a9025e5a29de48fcd86e3948df738bf82b2aa |
Portal Web, version 7.9.20 |
| Firefox extension / SHA-256 | herman-rich@browsertools[.]com6a3c00936b7f62652eb4970b2bd3bb895fdd9ec1ebae1dab19f0c50cfbdc6b4 |
Portal – Browser Extension, version 7.9.20 |
| Firefox extension / SHA-256 | live-football-scores@live-scores[.]com88d5b16c767e2527c14d2ae25dca6f4fe19f69517d0e00a2f26be055c575e3fe |
K WaIIet, version 1.4.5 |
| Firefox extension / SHA-256 | park-static-small@devblogs[.]comacf6f82916e78b2e5326fd16d6c97206532305cf5d68ea21e1a30537bffd26c0 |
Portal Web, version 7.9.20 |
| Firefox extension / SHA-256 | peters-schools@webtoolbrowser[.]com547a878083e4e3c39c240f27e9caaa190ef04661f46468234987980d907d9834 |
School-Theme – Browser Extension, version 8.12.13 |
| Firefox extension / SHA-256 | safe-stat-pure@proaddons[.]net8cec7990d4bc5e45034796fc63c63ba16781ac4303925ed1e80036668a9fe48e |
RABB-Walet Web3 EVM, version 9.70.20 |
| Firefox extension / SHA-256 | sharp-stat-gear@netplugs[.]net46c40d3cefb10a9fd1dfeb03ff1dc550674d391bdf05c0294257809d51c254a8 |
RabbitWALLET – EVM, version 9.10.10 |
| Firefox extension / SHA-256 | swift-clip-link@fasttools[.]coaa9d8f30bd6e0633af5bb0fa16ed2e87fcd22e87725c48a5c96884465e262a28 |
Web3 EVM, version 9.50.10 |
| Firefox extension / SHA-256 | vibe-timer-fast@extrakits[.]co5a7227dbf8e5c5c73f11c7df221c080252b337cb96b21f462d5ef17525f00f16 |
Crypto EVM, version 7.22.4 |
| Firefox extension / SHA-256 | {91ac3e4f-1874-409d-b01f-aeb2409a23b8}39827e214c31dbbf0ce20a40ee019cca2d96d621bf90dac4edc8b85a86311d09 |
exrb, version 711.0.1 |
| Firefox extension / SHA-256 | {b1f3c8a9-4a2e-4b7c-9e1f-8a3d6c5b4e2f}c7435c1659b6e0dc83487d03b3389ec22bb7e435c9b4c85a81f6c6504466060 |
ExtensionApp, version 1.0 |
| Firefox extension / SHA-256 | {d8a5f7c3-9e4b-2f2a-b1d7-8c7e9f4a2b3c}2b0d50aa0edf4f65e21b015fee169d68dc870a89d242836ccb3c7cef84db04c4 |
SOL, ETH, BTC, and more, version 1.1.2 |
| Firefox extension / SHA-256 | {d8a5f7c3-9e4b-4f2a-b1d6-8c7e9f3a2b2c}71f74a903b12fdaa1cb7683599b7956602768f23934578171f6453fdee7b3eac |
Web3 Portal, version 1.0 |
| Firefox extension / SHA-256 | {d8a5f7c3-9e9b-2f8a-b1d6-8c1e9f4a2b7c}3e4cd172c21c0c0d72c762fe84f07a9eb8f7c82f15add36bdf934ee42accf776 |
ETH, BTC, SOL and more, version 1.1.1 |
| Firefox extension / SHA-256 | {d8a5f9c3-9e4b-4f2a-b1d7-8c7e9f4a2b3c}918332da18e0f26378ee84408be13930da2d66cd80153cf18a5aa3d6d0cb2271 |
0KX WEB3, version 1.0.0 |
| Firefox extension / SHA-256 | {d9a5f9c3-9e4b-2f3a-b2d7-8c8e9f4a2b3c}fd67f4a3c8993b1ce6aecf0cc8902e6a8535a6ef56c0bad42d7e936d0a17e060 |
BASE EVM Web3, version 1.0.0 |
| Firefox extension / SHA-256 | {f746f950-bd73-43de-bfe1-add342147853}894398430972f91db2f1916f9fbe28b7319cb0e7d0e91a51e764fda5e7d1e8c9 |
trl, version 91.0.3; aliases include TrooonLink, TrLink, and owjdbfjfoof |
| Firefox extension / SHA-256 | bolt-save-vault@devplugs[.]cobee995e253092c8c8edfa4104799adbe40967596dfdb28a5668390aea40d0883 |
Rabby wallet impersonator, version 7.10.10 |
| Firefox extension / SHA-256 | core-note-nova@webtools[.]net66150abf5072f0d02118648d072afecdc8bac1d224dbc569836a65398d48e98d |
Rabby wallet impersonator, version 8.22.30 |
| Firefox extension / SHA-256 | deep-tip-sharp@browsify[.]co46305296e0675147c7b4ceacc7d5e45dd44d5d2242c0c3e02b444931b3e1564b |
Rabby wallet impersonator, version 6.7.10 |
| Firefox extension / SHA-256 | fast-zip-true@smartext[.]coe4c3a669362e8b456b1d6c8e6df7da2a9605a42d710d0cc951342b7ac0cb9d72 |
Rabby wallet impersonator, version 10.20.10 |
| Firefox extension / SHA-256 | flex-lab-save@foxplugin[.]coaeb6240b2f40a177999f68ae6fc88e511669d501aa298a433b05bafa89210685172b7618498d1c9da6ff6aecc8f680d2b3956b7c86d80fbc060e0adae8f38ebf |
RabbWALL EVM Web3 Manager, versions 7.10.30 and 8.10.30 |
| Firefox extension / SHA-256 | gear-save-tip@extrakits[.]examplee335066fb09d0d9d0e5fd55b946d430071fb6f157bdb9b38e7f50714178a51eb |
Rabbit WALL For Desktop, version 11.10.10 |
| Firefox extension / SHA-256 | pure-net-snap@fasttools[.]co61a19cab5c7bbcf5ded1c8b6a05d586ecbe03afc055c132049226f86f5127b3d |
Rabby wallet impersonator, version 9.11.30 |
| Firefox extension / SHA-256 | silver-fox@browser-app[.]com54d57acdd0557e22f9dd1350ac1bf1f536dd5859394b39cf9ba586b3d2339f05 |
RABB-WALLE Browser Extension, version 7.24.22 |
| Firefox extension / SHA-256 | smart-lab-glow@webkits[.]co40f6611eacbcf10f6260f91caeb4a2223313f466340f3ea9d47d6e34ee8b889a |
Rabby wallet impersonator, version 7.30.10 |
| Firefox extension / SHA-256 | {64d210f4-9b7f-489f-8207-e042400041b7}6db5ea393b1618259fee5a2ca7467be47ea025255d2ab45a78b76e23e4e0b59e |
Rabby Browser Extension, internal manifest name exrb, version 711.0.1 |
| Firefox extension / SHA-256 | {842fa1ed-b948-4bf8-b796-21044d3419eb}5c8121bd3394c4ea6d273a6936aeaa7d30aa748a978b440d7144819522813153 |
Raby, internal manifest name exrb, version 711.0.1 |
| Firefox extension / SHA-256 | {b0043917-9d75-425b-977a-4bb553f2a8ee}f0d262d1b1e446ee1a6db37b0301b9e2ab160269b193920212d55d7dfb231fe1 |
3abby – Browser Extension, internal manifest name exrb, version 711.0.1 |
| Firefox extension /
Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.
|
No Comment! Be the first one.