13 Malicious Rabby Firefox Extensions Steal Wallet Keyrings Before They Are Encrypted

A broad Firefox add-on campaign that includes 13 malicious Rabby Wallet impersonators engineered to exfiltrate wallet keyring data before the application encrypts it locally.

The activity is part of a larger operation, provisionally tracked as “Offside Wallet Theft Factory,” which links 77 Firefox extension identities through cloned code, reused infrastructure, deceptive listings, stable add-on IDs, and version repurposing.

The campaign has been active since at least March 2026. Of the 77 identified extensions, Socket confirmed 40 as malicious, while another 37 were deceptive sports-score shells that masqueraded as unrelated utilities.

Mozilla signing records for the initially analyzed samples span March 9 through August 3, with activity concentrated in April and late July.

The keyring-stealing cluster impersonates Rabby through lookalike names, including RABB-Wallet Web3 & EVM, Rabb-Wallet CryptoPortfolio, and Rabbit For Desktop.

Several samples use homoglyphs or subtle spelling changes to evade visual scrutiny while retaining the appearance of a recognized Web3 wallet brand.

Unlike simple phishing extensions, these builds embed their theft mechanism inside modified Rabby-derived wallet code.

Legitimate Rabby Wallet code serializes wallet keyrings, encrypts the resulting data, and then stores it locally.

The data is placed in a JSON field named ping and sent to distinct hardcoded webhook paths hosted on infrastructure associated with gemachriverdale[.]org and e-wl[.]com.

The collection endpoints use plain HTTP on port 9000 and follow a repeated /hook/ path design, giving defenders an actionable infrastructure pattern for network hunting.

This implementation defeats the protection offered by local wallet encryption: once the serialized keyring state has left the device, the legitimate wallet’s later encryption and storage process are irrelevant.

The malicious extension then allows the normal persistence flow to continue, preserving expected wallet behavior and limiting visible signs of compromise.

Package comparisons showed extensive code reuse across the Rabby-derived samples.

Socket found that the 13 malicious variants altered the persistAllKeyrings() workflow to transmit the serialized keyring array to attacker-controlled infrastructure before the encryption routine executes.

The Socket Threat Research team is tracking 77 Firefox extension identities linked through code reuse, cloned extensions, deceptive marketplace descriptions, author-selected add-on ID patterns and domain-like suffixes, cryptocurrency-wallet impersonation.

Eight variants were nearly byte-identical to a known malicious reference, with the primary changes concentrated in background.js, where operators rotated hardcoded exfiltration endpoints while retaining the same keyring theft logic.

13 Malicious Rabby Firefox Extensions

Historical Firefox package records also exposed the campaign’s staging model. Seven extension identities initially appeared as basketball, NBA, or American-football score applications before later updates repurposed those same Firefox IDs into keyring-stealing wallet extensions.

Another moved from a benign-looking utility into the same Rabby-derived malware family.

This history is significant because it demonstrates how attackers can establish an add-on identity with apparently harmless functionality, then weaponize it through a later update.

It also reinforces why extension security reviews should assess update lineage, package similarity, remote dependencies, and publisher artifacts not merely the current name, store description, or permission set.

The wider campaign also includes seven Supabase-controlled phishing loaders, 15 extensions that steal recovery phrases or private keys through Cloudflare Workers, and five extensions that collect credentials and clipboard data using hardcoded C2 infrastructure.

One counterfeit extension, 0KX WEB3, posed as an OKX wallet while functioning as a remotely controlled phishing delivery mechanism with a local notepad used as cover.

The operation’s sports-score shells used shared API-Sports credentials while advertising unrelated functions such as VPN access, dark mode, password generation, screenshots, and currency conversion.

Although the 37 analyzed sports-shell builds contained no confirmed theft payload, their deceptive functionality and direct version-history links to later wallet malware indicate that they may serve as staging assets in the publishing pipeline.

Users should obtain wallet extensions only through links published on the official wallet provider’s website, and should treat any exposed recovery phrase, private key, or wallet state as permanently compromised.

Mozilla says it uses automated risk indicators and human review to identify malicious wallet add-ons, but it also advises users to verify whether an extension is officially endorsed by the wallet provider.

For defenders, high-value signals include changes to persistAllKeyrings(), outbound cleartext traffic to port 9000, /hook/ webhook patterns, Rabby code reuse, homoglyph wallet branding, recycled Firefox IDs, and abrupt transitions from utility or sports-score functionality to wallet-related code.

IOCs

Firefox Extension ID	Observed Display Name	Version	SHA-256
bliss-heaven@webbrol.com	Safe-Themes – Browser Extension	8.12.13	08b7b064fa9a41b06774315d944ffddff705ab727222a0c3bcac64a77553bf2f
bold-page-vault@addonslab.example	Portal	7.9.17	4d0912d575087dab5f468214a2fd259bc386472a8b2b93b6e2441cde4bd941cb
bright-save-feed@tabtools.org	Rabbit For Desktop	8.20.10	26427220b9965e22deca0e617657c2c65b78f750183355d1265c147818367bd7

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide