40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets

Researchers have discovered 40 malicious Mozilla Firefox extensions that pretend to be legitimate Web3 products, such as OKX and TronLink, in order to steal cryptocurrency wallet secrets. These extensions are part of a larger group of 77 browser add-ons that share similar source code and infrastructure. The campaign, known as Offside Wallet Theft Factory, involves these extensions masquerading as well-known Web3 products to carry out wallet theft. The discovery was made by the Socket Threat Research team. The extensions target users by posing as trusted brands, including Rabby Wallet. The campaign's scope and impact are attributed to the shared code and infrastructure among the malicious extensions.