Offside Wallet Theft Factory: 77 Malicious Firefox Extensions Steal Crypto Wallet Seed Phrases via Supabase & Cloudflare Workers C2 — OTX Pulse Detection Pack

---
title: Firefox Extension Process Spawning Suspicious Network Egress to Serverless C2
id: 9f2c7a1e-4b3d-4e5f-8a6c-1d2e3f4a5b6c
status: experimental
description: Detects Firefox establishing connections to Cloudflare Workers or Supabase endpoints consistent with Offside Wallet Theft Factory exfiltration and remote-switch polling. Tune with known-good enterprise allowlists.
author: Security Arsenal Threat Intel
date: 2026/08/21
references:
    - https://socket.dev/blog/firefox-crypto-wallet-theft
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection_image:
        Image|endswith: '\firefox.exe'
    selection_dest:
        DestinationHostname|endswith:
            - '.workers.dev'
            - '.supabase.co'
    condition: selection_image and selection_dest
falsepositives:
    - Legitimate Web3 dApps and enterprise SaaS using Supabase backends accessed via Firefox
level: medium
tags:
    - attack.exfiltration
    - attack.t1041
    - attack.command_and_control
    - attack.t1071.001
---
title: DNS Resolution of Offside Wallet Theft Factory Hardcoded C2 Domains
id: 7a1b2c3d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects DNS queries for hardcoded command-and-control domains associated with the Offside Wallet Theft Factory malicious Firefox extension campaign (OTX pulse, Socket research).
author: Security Arsenal Threat Intel
date: 2026/08/21
references:
    - https://socket.dev/blog/firefox-crypto-wallet-theft
logsource:
    category: dns
detection:
    selection:
        query:
            - 'browser-app.com'
            - 'browsify.net'
            - 'gemachriverdale.org'
            - 'e-wl.com'
    condition: selection
falsepositives:
    - Threat intel research or sandbox detonation of the extensions
level: high
tags:
    - attack.command_and_control
    - attack.t1071.004
---
title: Malicious Firefox Extension Package Written to User Profile Extensions Directory
id: 2b3c4d5e-6f7a-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects file creation of known-malicious extension packages (by SHA256) or unexpected .xpi drops in Firefox profile extensions directories, indicating installation of Offside Wallet Theft Factory extensions.
author: Security Arsenal Threat Intel
date: 2026/08/21
references:
    - https://socket.dev/blog/firefox-crypto-wallet-theft
logsource:
    category: file_event
    product: windows
    service: sysmon
detection:
    selection_path:
        TargetFilename|contains:
            - '\Mozilla\Firefox\Profiles\'
            - '\extensions\'
    selection_ext:
        TargetFilename|endswith: '.xpi'
    selection_hash:
        Hashes|contains:
            - '08b7b064fa9a41b06774315d944ffddff705ab727222a0c3bcac64a77553bf2f'
            - '4d0912d575087dab5f468214a2fd259bc386472a8b2b93b6e2441cde4bd941cb'
            - '26427220b9965e22deca0e617657c2c65b78f750183355d1265c147818367bd7'
            - '252119fc48ad93b0c930d7a62fb49420cf8986716539e4e9d4d5c1bad700d435'
    condition: selection_hash or (selection_path and selection_ext)
falsepositives:
    - Legitimate extension installs or updates (hash match condition eliminates these; path-only condition requires baseline tuning)
level: high
tags:
    - attack.persistence
    - attack.t1176
    - attack.user_execution
    - attack.t1204

// Offside Wallet Theft Factory — Firefox extension exfil & C2 hunt (Microsoft Sentinel)
// Hunts: (1) known hardcoded C2 domains, (2) Firefox egress to serverless C2 platforms
let lookback = 14d;
let c2_domains = dynamic(["browser-app.com", "browsify.net", "gemachriverdale.org", "e-wl.com"]);
let hardcoded_c2 =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl has_any (c2_domains)
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType
    | extend HuntMatch = "Hardcoded C2 Domain";
let serverless_c2 =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName =~ "firefox.exe"
    | where RemoteUrl endswith ".workers.dev" or RemoteUrl endswith ".supabase.co"
    | summarize Connections = count(), DistinctHosts = dcount(RemoteUrl), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
    | extend HuntMatch = "Firefox -> Serverless C2 (Workers/Supabase)";
union hardcoded_c2, serverless_c2
| sort by TimeGenerated desc

# Offside Wallet Theft Factory - Endpoint IOC Hunt
# Checks Firefox profiles for malicious extensions, known-bad hashes, and live C2 connections
$ErrorActionPreference = 'SilentlyContinue'

$MaliciousHashes = @(
    '08B7B064FA9A41B06774315D944FFDDFF705AB727222A0C3BCAC64A77553BF2F',
    '4D0912D575087DAB5F468214A2FD259BC386472A8B2B93B6E2441CDE4BD941CB',
    '26427220B9965E22DECA0E617657C2C65B78F750183355D1265C147818367BD7',
    '252119FC48AD93B0C930D7A62FB49420CF8986716539E4E9D4D5C1BAD700D435'
)
$C2Domains = @('browser-app.com','browsify.net','gemachriverdale.org','e-wl.com')
$Findings = @()

Write-Host "[*] Enumerating Firefox profiles and hashing installed extensions..." -ForegroundColor Cyan
$profileRoots = Get-ChildItem "C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles" -Directory
foreach ($profile in $profileRoots) {
    $extDir = Join-Path $profile.FullName 'extensions'
    if (Test-Path $extDir) {
        Get-ChildItem $extDir -Recurse -Include *.xpi,*.json,*.js | ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
            if ($MaliciousHashes -contains $h) {
                $Findings += [PSCustomObject]@{Type='MALICIOUS EXTENSION HASH'; Path=$_.FullName; Hash=$h; Profile=$profile.Name}
                Write-Host "[!!] MALICIOUS EXTENSION: $($_.FullName) [$h]" -ForegroundColor Red
            }
        }
        # Flag non-standard extension IDs (factory variants use random GUIDs)
        Get-ChildItem $extDir -File | ForEach-Object {
            $Findings += [PSCustomObject]@{Type='Extension Inventory'; Path=$_.FullName; Hash=''; Profile=$profile.Name}
        }
    }
}

Write-Host "[*] Checking active connections and DNS cache for hardcoded C2..." -ForegroundColor Cyan
$conns = Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' }
foreach ($c in $conns) {
    try {
        $rdns = (Resolve-DnsName $c.RemoteAddress -ErrorAction Stop).NameHost
        foreach ($d in $C2Domains) {
            if ($rdns -like "*$d*") {
                $proc = (Get-Process -Id $c.OwningProcess).ProcessName
                Write-Host "[!!] LIVE C2 CONNECTION: $d ($($c.RemoteAddress)) via $proc" -ForegroundColor Red
                $Findings += [PSCustomObject]@{Type='LIVE C2 CONNECTION'; Path="$d -> $($c.RemoteAddress)"; Hash=$proc; Profile=''}
            }
        }
    } catch {}
}
$dnsCache = Get-DnsClientCache | Where-Object { $n = $_.Entry; $C2Domains | Where-Object { $n -like "*$_*" } }
if ($dnsCache) { $dnsCache | ForEach-Object { Write-Host "[!] DNS cache hit: $($_.Entry)" -ForegroundColor Yellow } }

Write-Host "[*] Checking recent DNS query log for serverless C2 abuse..." -ForegroundColor Cyan
$serverless = Get-DnsClientCache | Where-Object { $_.Entry -match '.workers.dev$|.supabase.co$' }
if ($serverless) { $serverless | Select-Object Entry, Data | Format-Table -AutoSize }

if ($Findings.Count -eq 0) { Write-Host "[+] No confirmed Offside Wallet Theft Factory indicators found." -ForegroundColor Green }
else { $Findings | Export-Csv ".\offside_hunt_findings.csv" -NoTypeInformation; Write-Host "[*] Findings exported to offside_hunt_findings.csv" }