Offside Wallet Theft Factory
Last changed 2026-10-10 · Re-researched — First published by the investigator agent. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5ivJ6o…QtSASummary
Offside Wallet Theft Factory is the name security firm Socket gave to a cluster of 77 related Firefox add-on identities, 40 of which it confirmed as malicious, that impersonated crypto wallets including OKX, Rabby Wallet, and TronLink to steal seed phrases, private keys, and other wallet secrets. The campaign was active on Mozilla's official add-on store from at least March 2026 through August 2026, with exfiltration carried out via Cloudflare Workers, Supabase-hosted phishing pages, and hardcoded command-and-control servers; no threat actor has been attributed. It follows a similar, separately attributed 2025 campaign ('FoxyWallet', reported by Koi Security) that impersonated Coinbase, MetaMask, and Trust Wallet, indicating a recurring attack pattern against the Firefox add-on store.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(6 events)
April 2025
Koi Security says a separate, earlier campaign ('FoxyWallet') impersonating Coinbase, MetaMask, Trust Wallet and other wallets begins appearing on the Firefox add-on store.
The Hacker NewsJuly 2025
Koi Security publishes research on the 'FoxyWallet' campaign, identifying more than 40 malicious Firefox extensions impersonating major crypto wallets.
The BlockMarch 2026
Mozilla's add-on signing records show the earliest analyzed version in the Offside Wallet Theft Factory cluster was signed, marking the start of the campaign's active window.
Decrypt, citing Socket researchAugust 2026
Mozilla's add-on signing records show the latest analyzed version in the cluster was signed, marking the end of the window covered by Socket's initial analysis.
Decrypt, citing Socket researchAugust 2026
Socket publishes research identifying 40 confirmed malicious Firefox extensions (within a cluster of 77 linked identities) impersonating OKX, Rabby Wallet, TronLink and other Web3 products, naming the cluster the 'Offside Wallet Theft Factory'.
Socket20 August 2026
The Hacker News reports on Socket's findings, widening coverage of the campaign.
The Hacker NewsDecision Log
- slot 455381789 · hash 8rdM5bGwzmy2Hf5d1rUFmjWetGGF1SKti2VJjGZb6YZi
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 5 of 6 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 10/10/2026, 8:08:57 PM
last updated: 10/10/2026, 8:08:57 PM
avoid.net — verified advice for a post-truth world