40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets
- ID
- 15986
- Status
- summarized
- Published
- 20 Aug 2026, 4:42 PM
- Fetched
- 20 Aug 2026, 7:26 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/40-malicious-firefox-extensions-pose-as.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.5
- Created
- 20 Aug 2026, 7:29 PM
- Tags
- Audience
- developersvibe_coders
What happened
Socket Threat Research identified 40 malicious Firefox extensions impersonating Web3 wallets like OKX, Rabby Wallet, and TronLink to steal recovery phrases, private keys, and clipboard data. The campaign, active since March 2026, used Supabase projects as remote switches and Cloudflare Workers for exfiltration, with some extensions initially published as innocuous sports-score utilities before being repurposed into wallet-stealing malware under the same Firefox ID.
Why it matters
If you build or ship browser extensions, the repurposing tactic here—publishing a benign utility first, then updating it to malicious functionality under the same extension ID—is a supply-chain pattern worth auditing in your own extension review processes. For anyone in Web3, avoid installing wallet extensions from Firefox's marketplace without verifying publisher identity against official sources, since 40 confirmed malicious add-ons passed through the official store.
Discussion angle
The extension-repurposing technique (benign shell → malicious update under same ID) is a broader platform-security problem beyond crypto—discuss whether Firefox's review process for extension updates is meaningfully different from Chrome's, and what this means for anyone distributing browser add-ons.