threat-intel
Malicious Firefox add-ons caught stealing cryptowallet seed phrases and browser credentials
High
Summary
A campaign of malicious Firefox add-ons, dubbed the "Offside Wallet Theft Factory", has been quietly stealing cryptocurrency wallet seed phrases and browser credentials since March 2026. Researchers identified 40 out of 77 linked extensions as actively stealing data, with the remaining extensions masquerading as VPNs or note-taking tools while secretly tracking sports scores. The campaign highlights a recurring tactic of cybercriminals leveraging seemingly legitimate browser extensions to gain access to sensitive information.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data