At Least 40 Malicious Firefox Extensions Found Stealing Crypto Wallet Seed Phrases and Private Keys

Security researchers at Socket said attackers have published at least 40 high-risk malicious extensions in Mozilla Firefox’s official add-on store, disguising them as major Web3 wallets including OKX, Rabby Wallet, and TronLink. The campaign, which Socket said has been active since March 2026, was described as an industrialized extension-based theft operation built to harvest seed phrases and private keys and then drain user funds. According to Socket’s Aug. 20, 2026 report, the operation extends beyond those 40 wallet-themed extensions. It also links to 37 decoy add-ons posing as sports score tools and other harmless utilities, bringing the total to 77 related repositories and release branches. Some extensions reportedly began as benign-looking tools and were later converted into wallet-stealing programs while keeping the same Firefox extension ID. Socket said the attackers relied on a shared codebase for mass distribution, used a Supabase cloud project as a remote command-and-control switch to activate malicious behavior after review, and kept reserve shell extensions ready to replace any add-ons taken down. The report also warned that browser extensions can access tabs, web requests, storage, and page content, making them especially dangerous for crypto users who enter seed phrases, private keys, and passwords in the browser.