AI Weekly Malaysia

Socket Threat Research identified 40 malicious Firefox extensions impersonating Web3 wallets like OKX, Rabby Wallet, and TronLink to steal recovery phrases, private keys, and clipboard data. The campaign, active since March 2026, used Supabase projects as remote switches and Cloudflare Workers for exfiltration, with some extensions initially published as innocuous sports-score utilities before being repurposed into wallet-stealing malware under the same Firefox ID.

Why: If you build or ship browser extensions, the repurposing tactic here—publishing a benign utility first, then updating it to malicious functionality under the same extension ID—is a supply-chain pattern worth auditing in your own extension review processes. For anyone in Web3, avoid installing wallet extensions from Firefox's marketplace without verifying publisher identity against official sources, since 40 confirmed malicious add-ons passed through the official store.