Executive Summary
A massive cluster of 77 Firefox browser extensions, dubbed 'Offside Wallet Theft Factory,' has been identified targeting Web3 users to steal cryptocurrency wallet secrets, private keys, and login credentials. The operation exhibits a high degree of automation and persistence, often initially publishing benign-looking 'sports-score' shells that are later updated with malicious payloads to evade initial marketplace review processes.
The technical execution varies across four main clusters: some use Supabase as a remote switch to serve phishing pages, others exfiltrate data via Cloudflare Workers, and some directly modify legitimate wallet code (like Rabby Wallet) to intercept keys before local encryption. The campaign has been active since at least March 2026, leveraging the low cost of extension rotation to maintain a scalable theft operation targeting digital assets.
This campaign poses a critical risk to users of decentralized finance (DeFi) and Web3 products. Because the extensions capture recovery phrases (seed phrases) and private keys, a single successful infection results in the immediate and permanent compromise of all assets within that wallet, even if the extension is subsequently removed.