A recent report identifies a critical cyber threat involving 77 malicious Firefox extensions designed to steal Web3 and crypto wallet information. The campaign, dubbed the Offside Wallet Theft Factory, targets users by impersonating legitimate crypto wallet extensions, such as OKX and Rabby, to capture sensitive data like recovery phrases and private keys. These extensions use various tactics, including remote phishing loaders and counterfeit wallet forms, to exfiltrate credentials.
The attacks use cloud services for data transfer and often rely on deception through legitimate branding. To mitigate risks, users are advised to only install extensions from official sources and avoid entering sensitive information in popups.