In August 2026, security firm Socket discovered two separate campaigns in which malicious browser extensions for Firefox, Chrome, and Edge harvested recovery phrases, private keys, and login credentials for crypto exchanges, affecting tens of thousands of users who installed them from official marketplace stores. The extensions sat in the official browser marketplaces, meaning users did nothing wrong when they installed them. This represents one of the largest coordinated wallet theft operations targeting everyday crypto holders through a trusted distribution channel.

How Did Attackers Hide Malicious Code in Official Browser Stores?

The Firefox campaign, which Socket named "Offside Wallet Theft Factory," involved 77 extension identities connected through shared code and infrastructure, with 40 confirmed as malicious. The attackers used a particularly clever technique: they took existing, legitimate applications like sports score apps and updated them with wallet-stealing code. When users received the automatic update, they inherited malicious functionality while keeping the accumulated positive reviews and user base of the original app.

The Chrome and Edge campaign involved 19 extensions, with 18 targeting Chrome and one targeting Edge. Five of these extensions followed the same pattern as the Firefox apps, taking over existing legitimate extensions and rebuilding them with theft code. The remaining 14 were built from scratch by the attackers. One particularly damaging extension called "Enable Right Click & Copy, Smart Unlock + OCR" had more than 70,000 users on Chrome and more than 10,000 on Edge before it turned malicious.

What Specific Threats Did These Extensions Pose to Wallet Holders?

The malicious extensions employed multiple theft techniques depending on their design. Some contained wallet drainers, which are malicious programs that empty an entire balance to an outside address in a single operation rather than siphoning off small amounts over time. Others intercepted recovery phrases at the moment wallets were created or imported. The most technically sophisticated versions targeted the Rabby wallet software, an open-source project that attackers modified to steal private keys at a critical moment.

In the altered Rabby versions, attackers rewrote a single function responsible for storing the keyring, which is the data record containing private keys and recovery phrases. In the original Rabby software, this keyring is converted to text and then encrypted with the user's password before being saved to the hard drive. In the malicious versions, the keyring was sent to attackers at the moment it existed in unencrypted text form, before the password protection could be applied. This meant the user's password provided no protection at that critical moment.

The Chrome and Edge extensions also included rebuilt recovery and update pages that mimicked the official interfaces of hardware wallet makers Ledger and Trezor, designed solely to collect recovery phrases from users. The attackers imitated the interfaces of OKX, Rabby Wallet, and TronLink as well, using these recognizable names and designs as bait without any involvement from the actual companies.

How to Protect Your Crypto Wallet From Browser Extension Threats

• Review Your Installed Extensions Regularly: Open your browser's extension list today and audit every extension you have installed. Remove any that you do not actively use or recognize. Pay special attention to extensions that request permission to read and modify content on all websites, as this is the permission level that makes wallet theft possible.
• Disable Automatic Updates for Critical Extensions: While most extensions update automatically by default, consider manually managing updates for wallet extensions and other security-sensitive tools. Check for updates yourself rather than allowing them to install silently in the background.
• Use Hardware Wallets for Large Holdings: If you hold significant amounts of cryptocurrency, consider using a dedicated hardware wallet like Ledger or Trezor rather than browser-based extensions. Hardware wallets keep private keys offline and are not vulnerable to browser-based malware, though be cautious of fake recovery pages designed to steal seed phrases.
• Verify Official Sources Before Installation: Before installing any wallet or crypto-related extension, verify the official website of the project and install only from links provided there. Attackers often create near-identical extension names to fool users into installing the wrong version.
• Monitor Your Accounts for Unauthorized Activity: If you installed any of the affected extensions, check your exchange accounts and wallets for unauthorized transactions or access attempts. Change your passwords and recovery phrases immediately if you suspect compromise.

Mozilla removed the reported Firefox extensions from its marketplace after Socket's report was published. At the time of Socket's publication, according to BleepingComputer reporting cited in the source material, none of the extensions was still available in the Chrome Web Store, though the Edge version remained available.

The technical infrastructure behind these campaigns reveals the sophistication of the operation. The attackers used Supabase, a database service, as remote switches to control the extensions, along with Cloudflare Workers and Pages to host forged wallet interfaces. Command and control servers were written directly into the code to receive stolen data and send new instructions back to the extensions. The signature data of the Firefox extensions covered the period from March 9 to August 3, 2026, with clusters of activity in April and at the end of July.

The scale of potential exposure remains partially unclear. One trade report cited around 80,000 affected users across both campaigns, though estimates vary on the timeline of the operation. Some assessments suggest the operation may have been running since early 2024, while others point to roughly six months of active operation beginning in February 2024. What is certain is that the extensions sat in official marketplaces where users had every reason to trust them, making this one of the most successful wallet theft campaigns targeting retail crypto holders through a mainstream distribution channel.

The incident underscores a fundamental vulnerability in browser-based wallet security. A browser extension with permission to read and modify content on all websites sits technically on the same level as the webpage itself, meaning it can see everything you type, see everything the page shows you, and alter both before either reaches the other. For wallet extensions, this level of access is necessary for the software to function. For extensions that display sports scores or unlock right-click menus, it represents an unnecessary security risk that attackers exploited to gain access to some of the most sensitive data in crypto: private keys and recovery phrases.