Full Report
A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, TronLink, and other Web3 products. According to the Socket Threat Research team, the extensions are part of a broader set of 77 browser add-ons that share source code and infrastructure overlaps. The campaign, dubbed Offside Wallet Theft Factory, is believed to
Analysis Summary
# Tool/Technique: Offside Wallet Theft Factory
## Overview
The **Offside Wallet Theft Factory** is a coordinated malware campaign involving a cluster of at least 77 malicious browser extensions (40 specifically targeting Mozilla Firefox). These extensions masquerade as legitimate Web3 applications, such as OKX, Rabby Wallet, and TronLink, to exfiltrate sensitive credentials and drain cryptocurrency assets from victims.
## Technical Details
- **Type:** Malware (Malicious Browser Extensions / Infostealer)
- **Platform:** Web Browsers (Mozilla Firefox, Google Chrome)
- **Capabilities:** Credential harvesting, mnemonic seed phrase theft, data exfiltration via WebSocket.
- **First Seen:** Reported February 2024 (Campaign likely active prior).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1189 - Drive-by Compromise
- T1566.002 - Phishing: Spearphishing Link (Redirects to malicious extension stores)
- **TA0006 - Credential Access**
- T1539 - Steal Web Session Cookie
- T1555.004 - Credentials from Web Browsers
- **TA0007 - Discovery**
- T1201 - Password Policy Discovery (Monitoring for wallet creation/import)
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel (WebSocket)
## Functionality
### Core Capabilities
- **Impersonation:** Employs high-fidelity cloning of legitimate Web3 wallet interfaces to deceive users into entering private keys or seed phrases.
- **Form Grabbing:** Intercepts data entered into input fields within the browser extension's UI.
- **C2 Communication:** Utilizes WebSockets for real-time data exfiltration to attacker-controlled infrastructure.
### Advanced Features
- **Shared Infrastructure:** The campaign utilizes a unified backend and source code template across 77 different extension variants, allowing for rapid deployment of "new" malicious tools.
- **Bypassing Reviews:** Uses legitimate-looking source code wrappers to bypass automated security checks in the Firefox Add-ons and Chrome Web Store.
## Indicators of Compromise
*Note: Specific hashes vary per extension version. Below are general indicators associated with the campaign.*
- **File Names (Example Extension Names):**
- OKX Wallet (Malicious clone)
- Rabby Wallet (Malicious clone)
- TronLink (Malicious clone)
- Various "Trade Helper" or "Crypto Viewer" utilities.
- **Network Indicators:**
- hxxps[://]api[.]offside[.]top (C2 Communication)
- hxxps[://]socket[.]offside[.]top (WebSocket Exfiltration)
- hxxps[://]cdn[.]offside[.]top (Resource Hosting)
- **Behavioral Indicators:**
- Extensions requesting `webRequest`, `storage`, and `tabs` permissions unexpectedly.
- WebSocket connections established immediately after a user interacts with a wallet extension.
## Associated Threat Actors
- **Unattributed:** Currently tracked as "Offside Wallet Theft Factory" or associated with the infrastructure domain `offside[.]top`.
## Detection Methods
- **Signature-based detection:** Monitoring for unique strings within `manifest.json` files linked to the `offside[.]top` domain.
- **Behavioral detection:**
- Identifying browser extensions that initiate WebSocket connections to unknown or newly registered domains (NRDs).
- Monitoring for high-volume clipboard access or unusual data transfers from browser extension processes.
- **YARA Rules:** Use rules targeting the specific JavaScript patterns used for exfiltrating mnemonic phrases (e.g., searching for "mnemonic", "private_key", and the WebSocket URL).
## Mitigation Strategies
- **Prevention measures:** Only install extensions from verified developers and use direct links from official project websites (e.g., okx.com).
- **Hardening recommendations:**
- Utilize hardware wallets (Cold Storage) which ensure private keys never interact with the browser environment.
- Implement Enterprise-level Browser Management policies to whitelist allowed extensions.
- Regularly audit "Authorized Extensions" in browser settings.
## Related Tools/Techniques
- **Raccoon Stealer:** Similar infostealing objectives but via standalone executable.
- **BitB (Browser-in-the-Browser):** A related technique used to spoof legitimate login windows.
- **Crypto-Chameleon:** Another campaign targeting mobile and web users with cloned cryptocurrency login pages.