Quick Take
- Socket identified 40 malicious Firefox add-on identities, including nine that shifted from sports-score tools to crypto-targeting software.
- Exposed recovery phrases, private keys, and serialized wallet keyrings remain compromised after uninstalling, requiring migration to fresh wallets.
- Mozilla removed one live phishing add-on, but confirmed victims, transactions, and total losses remain unidentified.
Software supply-chain security firm Socket found 40 Firefox add-on identities with confirmed malicious behavior, including draining crypto, including nine that had previously distributed sports-score tools under the same IDs.
Anyone whose recovery phrase, private key, or wallet keyring reached one of the malicious versions must treat that wallet as compromised because uninstalling the add-on cannot revoke an exposed secret.
The Aug. 19 report linked 77 identities to what Socket provisionally calls the “Offside Wallet Theft Factory,” with 40 containing confirmed malicious behavior. The other 37 were deceptive or suspicious sports-score shells whose analyzed versions contained no confirmed theft payload.
The campaign operated from at least March into August. Mozilla signing records for the original 59 versions analyzed by Socket ran from March 9 through Aug. 3, with activity clustering in April and late July.
Socket’s version histories show that the nine affected IDs were:
| Firefox ID | Earlier sports version | Later malicious version |
|---|---|---|
| bright-save-feed@tabtools.org | Quick Quick 7.4.0 | Rabbit For Desktop 8.20.10 |
| swift-clip-link@fasttools.co | Dial Open Pro 7.23.25 | Web3 & EVM 9.50.10 |
| deep-tip-sharp@browsify.co | Quick Shield 5.7.1 | Rby-WALLEТ 6.7.10 |
| bolt-save-vault@devplugs.co | Lite Swatch 6.5.21 | 🐇abby-WALLEТ 7.10.10 |
| core-note-nova@webtools.net | Key Pulse 8.1.21 | RABB-Walleť 8.22.30 |
| gear-save-tip@extrakits.example | Timer Pulse 5.5.5 | Rabbit WALLЕТ 11.10.10 |
| flex-lab-save@foxplugin.co | Track Quick 6.10.24 | RabbWALLЕТ 7.10.30/8.10.30 |
| pure-net-snap@fasttools.co | Store Plus 8.3.18 | Rabb🐇WALLЕТ 9.11.30 |
| fast-zip-true@smartext.co | Pomodoro Plus 9.13.24 | RABB-WALLEТ 10.20.10 |
Socket said several campaign add-ons were still live when it reported them to Mozilla. Its report noted that the remote-controlled phishing add-on 0KX WEB3 was live with seven users during analysis, and Mozilla removed it before publication.
What affected crypto users should do
The 40 malicious identities used distinct attack paths. Seven were remote-controlled phishing loaders, 15 captured recovery phrases, private keys, or other crypto wallet secrets, 13 modified clones of Rabby wallet software sent serialized keyrings away before local encryption, and five collected credentials and clipboard data.
A recovery phrase or private key can restore a wallet elsewhere, and a serialized keyring similarly exposes the wallet’s account state before encryption can protect it.
Anyone who entered one of those secrets, or used an affected build that transmitted its keyring, should move remaining assets to a fresh crypto wallet created from a new recovery phrase.
Users exposed only to the credential-and-clipboard group should change affected passwords, terminate active sessions where possible, and verify copied destination addresses. Wallet keys need rotation when wallet-secret or keyring exposure occurred.
Mozilla says it uses automated risk indicators and human review to identify malicious wallet add-ons, and advises users to install only extensions linked from the wallet provider’s official site.
Socket documented theft capability and exfiltration infrastructure, but did not identify confirmed victims, attributable transactions, or a campaign loss total.
Mentioned in this article
Editorial credits
