Offside Wallet Theft Factory: 40 Malicious Firefox Extensions Stealing Crypto Wallet Seeds — Detection and Removal Guide

---
title: Firefox Extension Installed via Sideloading or Profile Tampering
id: 3f8a2b91-7c4d-4e5f-9a1b-2c6d8e0f4a7b
status: experimental
description: Detects processes other than Firefox writing XPI extension files or modifying extensions.json in Firefox profiles, indicative of malicious extension sideloading as used in the Offside Wallet Theft Factory campaign.
references:
  - https://thehackernews.com/2026/08/40-malicious-firefox-extensions-pose-as.html
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Mozilla\Firefox\Profiles\'
  selection_target:
    TargetFilename|endswith:
      - '\extensions.json'
      - '\addonStartup.json.lz4'
      - '.xpi'
  filter_firefox:
    Image|endswith:
      - '\firefox.exe'
      - '\plugin-container.exe'
      - '\updater.exe'
  condition: selection_path and selection_target and not filter_firefox
falsepositives:
  - Enterprise extension deployment tools (intentional sideloading by IT)
  - Firefox Sync components
level: high
---
title: Firefox Network Connection to Cryptocurrency-Themed Typosquat Domain
id: 8c1d4e62-5a3b-4f78-b2e9-7d0c3a5f8e1d
status: experimental
description: Detects firefox.exe establishing connections to domains impersonating popular Web3 wallet brands, consistent with malicious extension C2/exfiltration in the Offside Wallet Theft Factory campaign.
references:
  - https://thehackernews.com/2026/08/40-malicious-firefox-extensions-pose-as.html
  - https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.exfiltration
  - attack.t1071.001
  - attack.t1176
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith: '\firefox.exe'
  selection_domain:
    DestinationHostname|contains:
      - 'okx-wallet'
      - 'okxwallet'
      - 'rabby-wallet'
      - 'rabbywallet'
      - 'tronlink'
      - 'tron-link'
      - 'tronwallet'
  filter_legit:
    DestinationHostname|endswith:
      - '.okx.com'
      - '.rabby.io'
      - '.tronlink.org'
  condition: selection_image and selection_domain and not filter_legit
falsepositives:
  - Users visiting unofficial fan sites or forums (review destination context)
level: high
---
title: Browser Process Reading Browser Extension Store of Another Profile
id: 5e7f3a18-2b9c-4d61-a8f4-9c1e6b3d5f2a
status: experimental
description: Detects non-browser processes accessing Firefox extension storage and WebExtension local storage, which can indicate credential/secret harvesting from installed wallet extensions.
references:
  - https://thehackernews.com/2026/08/40-malicious-firefox-extensions-pose-as.html
  - https://attack.mitre.org/techniques/T1555/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.credential_access
  - attack.t1555
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Mozilla\Firefox\Profiles\'
    TargetFilename|contains:
      - '\storage\default\'
      - '\extension-data\'
  filter_legit:
    Image|endswith:
      - '\firefox.exe'
      - '\plugin-container.exe'
  condition: selection and not filter_legit
falsepositives:
  - Backup software and EDR scanning engines (tune by process hash)
level: medium

// Hunt 1: Firefox extension files written by non-Firefox processes (sideloading)
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has @"\Mozilla\Firefox\Profiles\"
| where FileName endswith ".xpi" or FileName in~ ("extensions.json", "addonStartup.json.lz4")
| where InitiatingProcessFileName !in~ ("firefox.exe", "plugin-container.exe", "updater.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, SHA256
| order by TimeGenerated desc
;
// Hunt 2: firefox.exe connecting to wallet-brand typosquat / suspicious domains
let WalletBrands = dynamic(["okx", "rabby", "tronlink", "tron-link"]);
let LegitSuffixes = dynamic(["okx.com", "rabby.io", "tronlink.org"]);
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "firefox.exe"
| where RemoteUrl has_any (WalletBrands)
| where not(RemoteUrl has_any (LegitSuffixes))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessAccountName
| order by ConnectionCount desc
;
// Hunt 3: Rare outbound destinations from Firefox (candidate exfil infrastructure)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "firefox.exe"
| where isnotempty(RemoteUrl)
| summarize DeviceCount = dcount(DeviceId), TotalConns = count() by RemoteUrl
| where DeviceCount <= 2 and TotalConns < 50
| order by DeviceCount asc

-- Enumerate Firefox extensions and flag non-allowlisted / wallet-impersonating add-ons
LET profiles = SELECT FullPath
FROM glob(globs='C:/Users/*/AppData/Roaming/Mozilla/Firefox/Profiles/*/extensions.json')

LET parsed = SELECT
    FullPath AS ExtensionsJson,
    parse_json(filename=FullPath).addons AS Addons
FROM profiles

SELECT
    ExtensionsJson,
    item.id AS ExtensionID,
    item.defaultLocale.name AS ExtensionName,
    item.version AS Version,
    item.defaultLocale.creator AS Creator,
    item.location AS Location,
    item.signedState AS SignedState
FROM foreach(row=parsed,
query={
    SELECT * FROM foreach(row=Addons)
})
WHERE ExtensionName =~ '(?i)okx|rabby|tronlink|tron|wallet'
   OR SignedState < 2

# Offside Wallet Theft Factory - Firefox Extension Audit & Remediation Script
# Run per-user or deploy via RMM. Review the report BEFORE removing anything.

$reportPath = "$env:USERPROFILE\Desktop\Firefox_Extension_Audit_$(Get-Date -Format yyyyMMdd_HHmmss).csv"
$suspiciousBrands = 'okx|rabby|tronlink|tron|metamask|phantom|wallet'
$results = @()

# Enumerate all Firefox profiles for the current user
$profilesDir = "$env:APPDATA\Mozilla\Firefox\Profiles"
if (-not (Test-Path $profilesDir)) { Write-Host "No Firefox profiles found."; exit }

Get-ChildItem $profilesDir -Directory | ForEach-Object {
    $extJson = Join-Path $_.FullName "extensions.json"
    if (Test-Path $extJson) {
        $data = Get-Content $extJson -Raw | ConvertFrom-Json
        foreach ($addon in $data.addons) {
            $name = $addon.defaultLocale.name
            $flag = ""
            if ($name -match $suspiciousBrands) { $flag = "WALLET-BRAND MATCH - VERIFY AUTHENTICITY" }
            if ($addon.signedState -lt 2)          { $flag = ($flag + " | UNSIGNED/SIDELOADED").Trim(" |") }
            $results += [PSCustomObject]@{
                Profile      = $_.Name
                ExtensionID  = $addon.id
                Name         = $name
                Version      = $addon.version
                SignedState  = $addon.signedState
                Active       = $addon.active
                Flag         = $flag
            }
        }
    }
}

$results | Format-Table -AutoSize
$results | Export-Csv -Path $reportPath -NoTypeInformation
Write-Host "`nAudit complete. Report saved to: $reportPath"

$flagged = $results | Where-Object { $_.Flag -ne "" }
if ($flagged) {
    Write-Host "`n[!] $($flagged.Count) suspicious extension(s) found:" -ForegroundColor Red
    $flagged | Format-Table Name, ExtensionID, Flag -AutoSize
    Write-Host "ACTION: Remove flagged extensions via about:addons, rotate ALL wallet credentials," -ForegroundColor Yellow
    Write-Host "and move funds to a NEW wallet with a NEW seed phrase generated offline." -ForegroundColor Yellow
} else {
    Write-Host "`n[+] No wallet-brand or unsigned extensions detected." -ForegroundColor Green
}