Forty malicious Firefox add-ons make the case for extension allowlisting as a baseline

Socket's Threat Research team has confirmed 40 Firefox extensions as malicious, built to steal cryptocurrency wallet secrets while posing as OKX, Rabby Wallet, TronLink and other Web3 products ^[1][2]. They were published into the Firefox add-ons ecosystem, which is the part worth acting on: for most organisations the extension store is a software supply chain with no owner, no inventory and no change control ^[13][17].

Socket places the 40 inside a wider cluster of 77 add-ons that share source code and infrastructure, a campaign it calls Offside Wallet Theft Factory and dates to March 2026, with no attribution to any known actor or group ^[3][4][12]. The confirmed set splits four ways: seven use threat-actor-controlled Supabase projects as remote switches to serve phishing or decoy content dynamically; 15 capture recovery phrases, private keys and other wallet secrets and exfiltrate them through Cloudflare Workers; 13 are modified Rabby Wallet builds that push serialized keyrings out before local encryption; the remaining five take credentials and clipboard data through hard-coded command-and-control ^[6][7][8][9]. Those buckets add to exactly 40, and 28 of them, 70 percent, go straight for wallet key material ^[20][22].

Each of those design choices defeats a different common control. The wallet theft arrives either by remotely loading a fake wallet page or by baking the logic into the extension, so a clean build at review time proves nothing about the build a user is running ^[10][6]. Nine of the 40 malicious identities started as sports-score shells and were later repurposed into wallet stealers under the same Firefox ID, meaning install-time reputation and age heuristics were inherited rather than earned ^[14][13]. The other 31 had no sports API integration and carried confirmed wallet or credential theft outright ^[15], and nine plus 31 accounts for the full 40 ^[21]. Name inspection by eye is also not a control: the published titles include "℞ab␢y Wa❘Iet" and "Rabb-Walӏet CryptoPortfolio" ^[16]. Egress filtering fares no better when the exfiltration paths are Cloudflare Workers and Supabase ^[6][7].

The other 37 add-ons in the cluster ^[19] are score shells spanning football, basketball, NBA and hockey that share a hard-coded credential for the legitimate API-Sports service while marketing password generation, dark mode, VPN access, currency conversion, screenshot capture and note-taking ^[11]. Socket says their analysed builds contain no confirmed credential or wallet stealing payloads, but that their deceptive functionality, shared publishing artifacts and version histories indicate malicious intent ^[5].

The researcher, Kirill Boychenko, frames the persistence as arithmetic: one successful install can expose a recovery phrase or wallet state worth far more than the cost of repeatedly publishing disposable extensions, and rotating names and IDs, cloning code and splitting functionality across extensions, remote pages and cloud infrastructure makes republishing cheap and scalable ^[17][18]. Against an attacker with those economics, the only control that does not depend on winning a detection race is deny-by-default: an approved extension list enforced by policy, with everything else blocked. The ID reuse in this campaign is the caveat ^[14]. An allowlist pinned only to an extension ID can admit a later hostile version of an approved entry, so update review has to sit alongside it.

Watch whether any of the 37 shells flips to a stealing payload under an existing ID, since nine of the confirmed 40 already followed that path ^[5][14]. Watch, too, whether Mozilla starts treating a change of stated purpose under a stable Firefox ID as a re-review trigger rather than a version bump ^[13].