Socket identifies 40 malicious Firefox add-ons targeting crypto wallets

AI digestMimile.ai EditorialAugust 26, 2026 at 09:00 AM

This digest was compiled by AI from multiple sources — links to the originals are below.

Socket identifies 40 malicious Firefox add-ons targeting crypto wallets

Software supply-chain security firm Socket identified 40 Firefox add-on identities with confirmed malicious behavior, including crypto wallet draining. Nine of these identities previously distributed sports-score tools under the same IDs. Mozilla removed one live phishing add-on, but confirmed victims and total losses remain unidentified.

Key Facts

Socket identified 40 Firefox add-on identities with confirmed malicious behavior, including crypto wallet draining.
Nine of the 40 malicious identities previously distributed sports-score tools under the same IDs.
The campaign operated from at least March into August, with Mozilla signing records for the original 59 analyzed versions running from March 9 through Aug. 3.
Mozilla removed one live phishing add-on, 0KX WEB3, which had seven users during analysis.
Exposed recovery phrases, private keys, and serialized wallet keyrings remain compromised after uninstalling, requiring migration to fresh wallets.

Malicious Add-on Identities

Socket found 40 Firefox add-on identities with confirmed malicious behavior, including draining crypto. Nine of these identities had previously distributed sports-score tools under the same IDs. The Aug. 19 report linked 77 identities to what Socket provisionally calls the “Offside Wallet Theft Factory,” with 40 containing confirmed malicious behavior. The other 37 were deceptive or suspicious sports-score shells whose analyzed versions contained no confirmed theft payload. Mozilla signing records for the original 59 versions analyzed by Socket ran from March 9 through Aug. 3, with activity clustering in April and late July.

Attack Paths and Compromise

The 40 malicious identities used distinct attack paths: seven were remote-controlled phishing loaders, 15 captured recovery phrases, private keys, or other crypto wallet secrets, 13 modified clones of Rabby wallet software sent serialized keyrings away before local encryption, and five collected credentials and clipboard data. Anyone whose recovery phrase, private key, or wallet keyring reached one of the malicious versions must treat that wallet as compromised because uninstalling the add-on cannot revoke an exposed secret. Socket said several campaign add-ons were still live when it reported them to Mozilla. Its report noted that the remote-controlled phishing add-on 0KX WEB3 was live with seven users during analysis, and Mozilla removed it before publication.

1 source

Socket identifies 40 malicious Firefox add-ons targeting crypto wallets

cryptoslate.com

CryptoSlate

Technology

Socket finds 19 Chrome and Edge extensions with crypto-stealing code

Socket researchers identified 19 browser extensions—18 for Chrome and one for Edge—that steal wallet secrets and drain cryptocurrency. The extensions were published over the last six months, with evidence the campaign dates to February 2024. The threat actor acquired five extensions and created 14, pushing malicious updates after gaining users.

Technology

Bybit's $1.46 billion exploit shows 'audited' audits fail against interface deception

A $1.46 billion exploit at Bybit in February 2025 exposed the limits of smart-contract audits, showing that code-level reviews cannot prevent losses when signing interfaces are manipulated. The FBI attributed the theft to North Korea, and the exchange said signers were tricked by a compromised transaction display.

Technology

Adform tracking script compromised to replace crypto wallet addresses

Europe’s adtech firm Adform suffered a supply-chain attack that injected malicious code into its tracking script, replacing Bitcoin, Ethereum, and TRON wallet addresses copied to users’ clipboards. Security researcher Kevin Beaumont discovered the trojanized script, which exfiltrated victim data to an attacker-controlled server. Adform removed the code on July 27, but users who visited affected websites that day remain at risk.

Technology

Mirage2FA phishing campaign hits 4,500 companies, bypasses Microsoft 365 2FA

The Mirage2FA phishing-as-a-service campaign has targeted 4,532 organization email domains across the US and EU from 2024 to 2026. ANY.RUN research found 48% of targeted email addresses were potentially compromised, with 63.7% of victims in the United States. The campaign abuses legitimate Microsoft 365 login flows to bypass two-factor authentication and steal session cookies.

Socket identifies 40 malicious Firefox add-ons targeting crypto wallets

Key Facts

Malicious Add-on Identities

Attack Paths and Compromise

Read more

Read more