Fake Firefox Wallet Extensions Stealing Recovery Phrases: Socket Links 77 Identities

Published: 2026-08-25 14:14:15 |

Socket Threat Research says it linked a “Offside Wallet Theft Factory” campaign of fake Firefox wallet extensions. Of 77 linked Firefox extension identities, 40 were confirmed malicious and the rest acted as decoys. The fake Firefox wallet extensions impersonated OKX, Rabby Wallet, and TronLink. Many prompt users to import a wallet and then harvest recovery phrases/private keys typed into a counterfeit interface, while some modified Rabby builds steal stored account data, credentials, and clipboard content. Separately, Socket noted nine extensions began as sports-score apps under the same Firefox IDs, then quietly updated into wallet stealers—using the original install base and reviews. Mozilla signing records placed the activity roughly from March 9 to August 3, 2026, with some malicious add-ons still live when Socket reported them. Socket warns that if a recovery phrase or private key was entered, it should be treated as permanently compromised and funds moved immediately to a new wallet—uninstalling alone won’t revoke what was already sent. This is a clear reminder that fake Firefox wallet extensions remain a direct threat vector for trader keys and balances.

Neutral

This is a targeted cybersecurity incident rather than a protocol-level change, so it is unlikely to directly move crypto fundamentals. However, it can matter for traders: browser-based wallet theft can suddenly impact individual balances, increase scam-related volatility, and raise risk premiums around Web3 wallet software. Historically, major wallet-stealer disclosures (e.g., phishing campaigns targeting seed phrases or malicious browser extensions) tend to cause short-term sentiment dips and a spike in “key compromise” panic, but they rarely sustain broad market selloffs unless they coincide with wider exchange outages or major liquidity events. In the short term, users may reduce activity with unverified extensions and shift to safer browser profiles/hardware wallets, which can temporarily dampen risk-taking. In the long term, firms and wallets often harden signing, improve allowlisting, and distribute detection guidance. Overall, the market impact is more behavioral (risk management) than systemic, so the expected effect is neutral.