Image by CryptoSlate Socket confirmed 40 malicious IDs, and exposed crypto wallet secrets still require migration after the add-ons are removed. Editor-in-Chief CryptoSlate
Socket identified 40 malicious Firefox add-on identities, including nine that shifted from sports-score tools to crypto-targeting software.
Exposed recovery phrases, private keys, and serialized wallet keyrings remain compromised after uninstalling, requiring migration to fresh wallets. Mozilla removed one live phishing add-on, but confirmed victims, transactions, and total losses remain unidentified.
Software supply-chain security firm Socket found 40 Firefox add-on identities with confirmed malicious behavior, including draining crypto, including nine that had previously distributed sports-score tools under the same IDs. Anyone whose recovery phrase, private key, or wallet keyring reached one of the malicious versions must treat that wallet as compromised because uninstalling the add-on cannot revoke an exposed secret. The Aug. 19 report linked 77 identities to what Socket provisionally calls the “Offside Wallet Theft Factory,” with 40 containing confirmed malicious behavior.
The other 37 were deceptive or suspicious sports-score shells whose analyzed versions contained no confirmed theft payload. The campaign operated from at least March into August.
More Read
Mozilla signing records for the original 59 versions analyzed by Socket ran from March 9 through Aug. 3, with activity clustering in April and late July.
Infographic showing 77 Firefox wallet extension IDs, including 40 confirmed malicious extensions using phishing, credential theft, and wallet-draining techniques. Socket’s version histories show that the nine affected IDs were:
Firefox ID Earlier sports version Later malicious version bright-save-feed@tabtools.org Quick Quick 7.4.0 Rabbit For Desktop 8.20.10 swift-clip-link@fasttools.co Dial Open Pro 7.23.25 Web3 & EVM 9.50.10 deep-tip-sharp@browsify.co Quick Shield 5.7.1 Rby-WALLEТ 6.7.10 bolt-save-vault@devplugs.co Lite Swatch 6.5.21 🐇abby-WALLEТ 7.10.10 core-note-nova@webtools.net Key Pulse 8.1.21 RABB-Walleť 8.22.30 gear-save-tip@extrakits.example Timer Pulse 5.5.5 Rabbit WALLЕТ 11.10.10 flex-lab-save@foxplugin.co Track Quick 6.10.24 RabbWALLЕТ 7.10.30/8.10.30 pure-net-snap@fasttools.co Store Plus 8.3.18 Rabb🐇WALLЕТ 9.11.30 fast-zip-true@smartext.co Pomodoro Plus 9.13.24 RABB-WALLEТ 10.20.10 Socket said several campaign add-ons were still live when it reported them to Mozilla. Its report noted that the remote-controlled phishing add-on 0KX WEB3 was live with seven users during analysis, and Mozilla removed it before publication. What affected crypto users should do The 40 malicious identities used distinct attack paths. Seven were remote-controlled phishing loaders, 15 captured recovery phrases, private keys, or other crypto wallet secrets, 13 modified clones of Rabby wallet software sent serialized keyrings away before local encryption, and five collected credentials and clipboard data. A recovery phrase or private key can restore a wallet elsewhere, and a serialized keyring similarly exposes the wallet’s account state before encryption can protect it. Anyone who entered one of those secrets, or used an affected build that transmitted its keyring, should move remaining assets to a fresh crypto wallet created from a new recovery phrase.
More Read
Users exposed only to the credential-and-clipboard group should change affected passwords, terminate active sessions where possible, and verify copied destination addresses. Wallet keys need rotation when wallet-secret or keyring exposure occurred. Mozilla says it uses automated risk indicators and human review to identify malicious wallet add-ons, and advises users to install only extensions linked from the wallet provider’s official site. Socket documented theft capability and exfiltration infrastructure, but did not identify confirmed victims, attributable transactions, or a campaign loss total.
Article context
Mentioned in this article Editorial credits Follow the signal
Curated intelligence, delivered your way. Never miss a market-moving update. Daily briefingTop stories & analysis Market movesKey charts & data Policy updatesWhat to watch Weekly deep diveLong-form insights
