Threat Summary
The three OTX pulses converge on one enterprise risk: identity is being attacked at the browser, session, and hiring-workflow layers rather than only through endpoint malware. The 'Offside Wallet Theft Factory' used 77 Firefox extensions, with 40 confirmed malicious, to steal wallet recovery phrases, private keys, and credentials while using Supabase remote switches, Cloudflare Workers, and hardcoded C2 to separate benign-looking extension code from live exfiltration. Mirage2FA, attributed to LinX Coders, is a phishing-as-a-service operation that uses Adversary-in-the-Middle relays, HTML smuggling, WebSocket channels, and Microsoft 365 lookalike infrastructure to capture credentials plus authenticated sessions and bypass MFA. PurpleDelta represents a different but compounding intrusion path: North Korean IT workers using fabricated personas, AI-generated photos, custom ChatGPT assistants, and fraudulent documents to obtain legitimate remote employment and insider access.
Collectively, the activity targets cryptocurrency/Web3 users, Microsoft 365 tenants in Technology, Manufacturing, Education, Finance, Healthcare and Telecommunications, and enterprise hiring pipelines in Technology, Healthcare, Finance, Media and NGOs. The shared objective is durable account access and monetization: steal seed phrases and browser secrets, replay M365 session cookies/tokens after MFA, or become a trusted insider with sanctioned VPN, source-code, payroll, and SaaS access.
Threat Actor / Malware Profile
Offside Wallet Theft Factory / Firefox extension campaign: Distribution relies on malicious or trojanized Firefox extensions that impersonate wallet, browser utility, Web3, or productivity add-ons. Payload behavior is credential and secret harvesting: recovery phrases, private keys, cookies, local storage, saved logins, and clipboard or form data. C2 is modular and cloud-abusing: Supabase acts as a remote configuration/kill-switch layer, Cloudflare Workers provide resilient relay and logic, and hardcoded domains such as browser-app.com, browsify.net, gemachriverdale.org, and e-wl.com support exfiltration. Persistence is achieved by remaining installed as a browser extension, auto-loading at browser start, updating remotely, and surviving endpoint cleanup that ignores browser profiles. Anti-analysis includes dormant behavior until remote switches enable theft, traffic blended into legitimate cloud platforms, and extension code split across benign and remotely fetched components.
Mirage2FA / LinX Coders: Distribution is phishing email and lure pages that use HTML smuggling to assemble credential/session relays client-side. The kit proxies the real Microsoft 365 login flow, captures username, password, MFA response, and post-authentication cookies/tokens, then enables immediate session replay. C2 uses WebSocket-heavy AiTM infrastructure and lookalike/burner domains such as galatasaraydanhaberler.com, sopbtech.store, office.pcvgtech.store, ver.verpox.shop, cementslabconstruction.com, adp.pslcertlive.site, ans.rsxbenefits.com, and ari.vslbertlive.info. Persistence is not host-based; it persists through stolen session cookies, refresh tokens, inbox rules, added MFA methods, OAuth grants, and conditional-access gaps. Anti-analysis includes short-lived domains, victim-fingerprinting, and real-time proxying that makes the page appear legitimate while credentials pass through attacker infrastructure.
PurpleDelta / DPRK IT worker operations: This is an adversary-enabled insider threat rather than a classic malware family. Operators apply to remote jobs using at least 22 fabricated personas, AI-generated profile photos, fraudulent identity documents, and custom ChatGPT assistants for interviews, coding tasks, and communications. Distribution is the hiring process itself. Payload behavior is legitimate work plus unauthorized access, data staging, sanctions-evasion revenue generation, and potential handoff to intrusion sets. Persistence is granted by HR onboarding, SSO accounts, contractor laptops, VPN/ZTNA access, code repositories, ticketing systems, and payroll rails. Anti-detection relies on clean endpoints, real video liveness attempts, timezone/socioengineering playbooks, laptop farms, and legitimate credentials.
IOC Analysis
The current indicator set is dominated by domains and hostnames, plus SHA256 hashes for malicious extension artifacts; PurpleDelta has restricted indicators and should be hunted behaviorally. SOC teams should treat domains/hostnames as high-velocity blocklist and retro-hunt objects across DNS, proxy, TLS SNI, firewall, EDR network events, and browser telemetry. Hashes should be swept against download caches, browser extension stores, email detonation, software distribution, and EDR file reputation. For AiTM infrastructure, prioritize session anomaly detection over static IPs because relay domains rotate and may sit behind CDN edges. Tooling that decodes and operationalizes these indicators includes EDR/VirusTotal hash reputation, urlscan.io and ANY.RUN for phishing-page detonation, PassiveTotal/SecurityTrails for infrastructure pivoting, Microsoft Defender for Endpoint/Identity for token replay signals, Sentinel for correlation, and browser management planes that can enumerate installed extensions. Map indicators to MITRE ATT&CK: T1176 Browser Extensions, T1189 Drive-by Compromise, T1566 Phishing, T1557 Adversary-in-the-Middle, T1539 Steal Web Session Cookie, T1552 Unsecured Credentials, T1078 Valid Accounts, and T1098 Account Manipulation for persistence after compromise.
Detection Engineering
---
title: OTX Offside Wallet Theft Factory Firefox Extension IOC Domain Access
id: 9d4b8d3a-7f0c-4a1e-b6f2-otxoffside01
status: experimental
description: Detects endpoint or proxy network access to domains associated with the Offside Wallet Theft Factory Firefox extension campaign. Tune for DNS, proxy, TLS SNI, and EDR network telemetry.
author: Security Arsenal
logsource:
category: network_connection
product: windows
detection:
selection_domain:
DestinationHostname|endswith:
- browser-app.com
- browsify.net
- gemachriverdale.org
- e-wl.com
selection_initiated:
Initiated: 'true'
condition: selection_domain and selection_initiated
falsepositives:
- Rare; validate any business browser extension use and sanctioned Web3 tooling.
level: high
tags:
- attack.t1176
- attack.t1071
- attack.t1552
- attack.command_and_control
date: 2026/09/19
---
title: OTX Mirage2FA AiTM Phishing Infrastructure Access
id: 2f7a1c44-8b6d-4d19-9ce3-otxmirage01
status: experimental
description: Detects network access to Mirage2FA Microsoft 365 AiTM phishing hostnames and burner domains observed in OTX pulse telemetry.
author: Security Arsenal
logsource:
category: network_connection
product: windows
detection:
selection_domain:
DestinationHostname|endswith:
- galatasaraydanhaberler.com
- sopbtech.store
- pcvgtech.store
- verpox.shop
- cementslabconstruction.com
- pslcertlive.site
- rsxbenefits.com
- vslbertlive.info
selection_port:
DestinationPort:
- 443
- 80
condition: selection_domain and selection_port
falsepositives:
- Minimal; confirm whether any hostname is used by a legitimate vendor before lower-severity tuning.
level: critical
tags:
- attack.t1566
- attack.t1557
- attack.t1539
- attack.phishing
date: 2026/09/19
---
title: Suspicious Firefox Extension Install With Cloud Worker Or Supabase Exfil
id: 77bb10a2-5b4a-4f17-a9ef-otxwebext01
status: experimental
description: Detects Firefox profile extension changes followed by outbound access to Supabase or Cloudflare Workers, a pattern consistent with remotely switched malicious WebExtension exfiltration.
author: Security Arsenal
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\firefox.exe'
- '\powershell.exe'
- '\cmd.exe'
- '\rundll32.exe'
selection_cli:
CommandLine|contains:
- 'extensions.json'
- '.xpi'
- 'mozilla\\firefox\\profiles'
- 'supabase.co'
- 'workers.dev'
- 'browser-app.com'
- 'browsify.net'
condition: selection_img and selection_cli
falsepositives:
- Enterprise browser extension deployment, developer debugging, Web3 wallet administration.
level: medium
tags:
- attack.t1176
- attack.t1105
- attack.t1552
- attack.execution
date: 2026/09/19
let OTX_Domains = dynamic(["browser-app.com","browsify.net","gemachriverdale.org","e-wl.com","galatasaraydanhaberler.com","sopbtech.store","pcvgtech.store","verpox.shop","cementslabconstruction.com","pslcertlive.site","rsxbenefits.com","vslbertlive.info"]);
let Lookback = 14d;
union withsource=TableName_ (DeviceNetworkEvents | where TimeGenerated > ago(Lookback) | extend Host = tolower(RemoteUrl), RemoteHost = tolower(RemoteIP)), (DeviceProcessEvents | where TimeGenerated > ago(Lookback) | extend ProcessCmd = tolower(ProcessCommandLine), FileNameLower = tolower(FileName))
| extend DomainHit = case(
TableName_ == "DeviceNetworkEvents" and (RemoteUrl has_any (OTX_Domains) or RemoteIP in (OTX_Domains)), "OTX network IOC",
TableName_ == "DeviceProcessEvents" and ProcessCmd has_any (OTX_Domains), "OTX IOC in process command line",
"none")
| where DomainHit != "none" or (TableName_ == "DeviceProcessEvents" and (ProcessCmd has "extensions.json" or ProcessCmd has ".xpi" or ProcessCmd has "mozilla\\firefox\\profiles" or ProcessCmd has "supabase.co" or ProcessCmd has "workers.dev"))
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Accounts=dcount(AccountName), Devices=dcount(DeviceName) by TableName_, DeviceName, AccountName, FileNameLower, ProcessCmd, RemoteUrl, RemoteIP, DomainHit
| order by LastSeen desc;
// Identity companion: hunt impossible travel, token replay, new MFA methods, inbox rules, and OAuth grants after any OTX_Domains hit or unfamiliar M365 login.
SigninLogs
| where TimeGenerated > ago(Lookback)
| where AppDisplayName has_any ("Office 365","Microsoft Office","Microsoft Teams","SharePoint","Exchange") or ResourceDisplayName has "Office 365"
| extend Risk = tostring(conditional_access_status)
| where Status.errorCode != 0 or RiskState has_any ("atRisk","confirmedCompromised") or AuthenticationDetails has "MFA"
| project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, ClientAppUsed, DeviceDetail, Status, RiskState, AuthenticationRequirement
| order by TimeGenerated desc;
# OTX hunt: Firefox extension artifacts, suspicious browser profile changes, and DNS/network remnants.
$ErrorActionPreference = 'SilentlyContinue'
$otxDomains = @('browser-app.com','browsify.net','gemachriverdale.org','e-wl.com','galatasaraydanhaberler.com','sopbtech.store','pcvgtech.store','verpox.shop','cementslabconstruction.com','pslcertlive.site','rsxbenefits.com','vslbertlive.info','supabase.co','workers.dev')
Write-Host '[+] Firefox profile extension inventory'
Get-ChildItem "$env:APPDATA\Mozilla\Firefox\Profiles" -Recurse -Include extensions.json,addonStartup.json.lz4,*.xpi | Select-Object FullName,Length,LastWriteTime
Get-ChildItem "$env:APPDATA\Mozilla\Firefox\Profiles" -Recurse -Filter *.xpi | ForEach-Object { try { Get-FileHash $_.FullName -Algorithm SHA256 | Select-Object Hash,Path } catch {} }
Write-Host '[+] Recent downloads for XPI/HTML smuggling lures'
Get-ChildItem "$env:USERPROFILE\Downloads" -Recurse -Include *.xpi,*.html,*.htm,*.zip -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | Select-Object FullName,LastWriteTime,Length
Write-Host '[+] DNS cache matches for OTX domains'
$dns = Get-DnsClientCache
foreach ($d in $otxDomains) { $dns | Where-Object { $_.Entry -like "*$d*" -or $_.Data -like "*$d*" } | Select-Object Entry,Data,Status }
Write-Host '[+] Established/recent TCP connections to suspicious hosts'
Get-NetTCPConnection | Where-Object { $_.State -in @('Established','SynSent','TimeWait') } | ForEach-Object { $r=$_; try { $name=(Resolve-DnsName $r.RemoteAddress -ErrorAction Stop).NameHost } catch { $name='' }; if ($otxDomains | Where-Object { $name -like "*$_*" }) { [pscustomobject]@{Local=$r.LocalAddress;Remote=$r.RemoteAddress;Resolved=$name;State=$r.State;OwningProcess=(Get-Process -Id $r.OwningProcess).ProcessName} } }
Write-Host '[+] Persistence surfaces: Run keys and scheduled tasks referencing browser/extension/cloud terms'
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' | Select-Object *
Get-ScheduledTask | Where-Object { ($_.TaskName + ' ' + $_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'firefox|xpi|extensions.json|supabase|workers.dev|m365|office|token|cookie' } | Select-Object TaskName,TaskPath,State,Actions
Write-Host '[+] Recommended containment checks: enumerate installed Firefox extensions, disable unknown add-ons, revoke M365 sessions, reset credentials, review MFA/OAuth/inbox rules after any hit.'
Response Priorities
Immediate: Block and retro-hunt all listed domains/hostnames across DNS, proxy, TLS SNI, firewall, EDR network telemetry and email security. Quarantine confirmed malicious Firefox extension hashes, force-remove unknown extensions through browser policy, isolate affected endpoints, capture browser profile directories before cleanup, and search for .xpi, extensions.json, Supabase, Cloudflare Worker, and OTX domain references. For Mirage2FA hits, treat sessions as compromised even when MFA succeeded: revoke refresh tokens, sign out all sessions, disable legacy auth, and inspect inbox rules, forwarding, OAuth consents, added MFA methods, and recent SharePoint/Exchange access.
24h: Reset credentials for impacted users and any users who authenticated near an AiTM domain hit. Enforce phishing-resistant MFA or re-register MFA after token revocation. Review Conditional Access, impossible travel, token replay, and unusual client app usage. For Web3/cryptocurrency exposure, assume seed phrases/private keys are burned, rotate wallets, move funds, and audit clipboard/form autofill exposure. For PurpleDelta, trigger HR-security review: verify identity documents, payroll bank changes, shipping addresses for corporate laptops, interview consistency, IP/geolocation of work sessions, repository commits, and access to sensitive SaaS. Preserve chat, interview, code-commit, badge/VPN/ZTNA, and endpoint provisioning logs.
1 week: Harden architecture around the attack vectors: allowlist browser extensions, block unsigned/unreviewed .xpi installation, restrict browser access to arbitrary Supabase/Workers endpoints where feasible, deploy FIDO2/passkeys and token-binding where possible, require compliant-device Conditional Access, alert on new MFA/OAuth/inbox-rule changes, separate contractor access with least privilege and device attestation, add DPRK IT-worker indicators to background and onboarding checks, and implement out-of-band verification for payroll, laptop shipment, and identity-proofing exceptions.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.