Malicious Firefox Crypto Wallet Extensions: Indicators and Exposed-Secret Response

Direct answer

Socket linked 77 Firefox add-on identities and confirmed 40 malicious; 37 related sports-score shells had no confirmed theft code in analyzed builds. The campaign was reported in August, not newly removed on October 9. Check installed identities and versions, and treat secrets entered into suspicious extensions as exposed. Uninstalling cannot make a disclosed recovery phrase confidential again.

Original event dates and this article

Independent campaign reporting: August 20–25 2026; Socket original page did not expose a reliable publication clock. Activity was traced to at least March. Primary per-add-on Mozilla removal dates were not established.

What happened

The campaign, which Socket calls the Offside Wallet Theft Factory, was active from at least March 2026. Some add-ons looked like wallets associated with OKX, Rabby Wallet or TronLink. Others appeared to be themes, note-taking tools, VPNs, password generators or sports-score utilities. In several cases, a harmless-looking identity was later repurposed under the same Firefox ID.

One example was 0KX WEB3. The zero in “0KX” imitates the name of the OKX exchange. Socket’s indicator list records this Firefox identity as {d8a5f9c3-9e4b-4f2a-b1d7-8c7e9f4a2b3c}, observed at version 1.0.0. Bitdefender’s review says the package did not contain a real wallet. Instead, it used a Supabase project as a remote switch. The extension could display a decoy and later load a convincing wallet-import page. Anyone who typed a recovery phrase into that page would have disclosed it to the operators.

Socket reported several other confirmed malicious examples, including Safe-Themes - Browser Extension version 8.12.13 (bliss-heaven@webbrol.com), Rabbit For Desktop version 8.20.10 (bright-save-feed@tabtools.org), ℞ab␢y Wa❘Iet version 2.4.9 (flex-clock-dash@extrakits.com), Rabb-Walӏet CryptoPortfolio version 88.10.10 (free-note-bolt@webtools.co), RABB-Walӏet Web3 & EVM version 9.70.20 (safe-stat-pure@proaddons.net) and Rabbit/WALLET - EVM version 9.10.10 (sharp-stat-gear@netplugs.net). These are observed indicators, not a claim that every historical version is known.

What could be exposed

Socket’s technical breakdown identified different behaviors across the confirmed malicious set. Some extensions could present remote phishing content. Others captured recovery phrases, private keys or wallet data. Socket also reported modified Rabby Wallet builds that exfiltrated serialized keyrings before local encryption, plus extensions that captured credentials or clipboard data through hard-coded infrastructure.

The evidence shows a route to potential wallet compromise and credential theft. It does not establish that every person who installed an affected add-on lost money, that every installation was activated, or that a particular number of victims had funds stolen. It also does not establish a Firefox vulnerability or a CVE. The reported mechanism was malicious extension behavior and deceptive wallet pages.

Mozilla’s Add-ons team has previously described its process for detecting and blocking scam crypto-wallet extensions. The 2026 reporting says the researchers reported these findings to Mozilla and that the fraudulent extensions were removed and blocklisted. However, the fetched primary Socket report does not provide an exact per-add-on removal date, and Mozilla has not published a primary 2026 post naming all of these identities in the material reviewed here. Treat the removal timing as not independently established, rather than assuming all 40 disappeared on one date.

How to check Firefox safely

Open Firefox’s Add-ons Manager and review the installed extensions. Compare unfamiliar wallet or utility add-ons against their displayed names, publisher information, Firefox IDs and installed versions. Pay particular attention to the indicators above, including look-alike names that use unusual characters or substitute a zero for a letter.

If you do not recognize an extension, disable it and remove it. Do not reinstall a wallet from a search result or an unsolicited message. Verify the software independently through a known genuine publisher record; do not treat an unfamiliar store listing as sufficient proof. A small permission list is not proof of safety: the reported campaign included extensions that relied on remote pages and asked for little access.

If you entered a recovery phrase or private key into an affected extension or a wallet-import page it opened, assume that secret is compromised. Do not reuse the exposed phrase or enter it into another site suggested by the suspicious extension. Use a separate trusted device to obtain qualified recovery guidance; removing an add-on cannot make an exposed wallet secret confidential again. Review browser passwords and any credentials entered through the extension, change them from a clean environment, and enable multi-factor authentication where available. Keep records of suspicious extension names and versions for incident reporting.

Removing an extension is still important, but it is not automatic account recovery. Uninstalling it cannot undo a recovery phrase or password that was already disclosed.

Does Firefox automatically clean up every affected installation?

The available reporting says Mozilla removed and blocklisted the fraudulent add-ons from its store. That does not prove that every previously installed copy was automatically cleaned up on every device. Check Firefox’s installed add-ons yourself and investigate any wallet secret or password that may have been entered.

Were the 37 sports-score extensions confirmed to steal wallets?

No. Socket classified 40 extensions as malicious. The other 37 were deceptive sports-score shells with shared code or infrastructure, but their analyzed builds did not contain confirmed wallet- or credential-stealing payloads. Some historical versions of identities later classified as malicious had started as sports-score shells, so version history matters.

Decision checklist

• Review installed add-on names, publisher identities and versions in Firefox.
• Match suspicious indicators to the analyzed versions; do not assume every historic build is identical.
• Disable suspicious add-ons, preserve identity/version details, then remove them.
• Do not enter recovery phrases into unsolicited support or wallet-import pages.
• Use a trusted device to review exposed accounts and reset affected passwords.
• Treat exposed wallet secrets as compromised; obtain qualified recovery guidance without sharing them.

Limitations

• Socket linked 77 identities and confirmed 40 malicious; 37 related deceptive sports-score shells had no confirmed theft payload in analyzed builds. These distinctions matter. A store removal report does not prove every previously installed copy was cleaned or every user lost funds.
• Reviewed 9 October 2026; source-event dates differ from this article’s first publication.
• General defensive guidance is not a diagnosis or complete-cleanup guarantee.
• No verified query volume, Google Trends score, victim total or ranking guarantee is asserted.

Evidence sources

1. Socket Threat Research — Socket primary research — identities, 40/37 distinction and observed behavior
2. Mozilla Add-ons — Mozilla primary 2025 context — scam detection process, not 2026 per-add-on removal proof
3. Bitdefender — Bitdefender August 24 — independent corroboration
4. The Hacker News — The Hacker News August 20 — independent campaign coverage