Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
40 Malicious Firefox Extensions Steal Crypto Wallet Recovery Phrases, Private Keys and Credentials
Excerpt
cextensions designed to steal wallet recovery phrases, private keys, credentials, and clipboard data. Researchers also identified 37 related deceptive extensions that posed as useful tools but delivered sports-score content instead. The campaign, tracked as “Offside Wallet Theft Factory,” has been active since at least March 2026. It relies on cloned code, misleading listings, reused Firefox add-on identities, and fake wallet branding to trick users. The extensions…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://portal-web3-extension-welcome.pages.dev/home | High | Score 58/100 | First seen |
| URL | https://kyfyvuwifdukctqyggto.supabase.co | High | Score 58/100 | First seen |
| SHA1 | 873640fa90994d9c42b9b5fa64efa3ab40e143aa | Medium | Score 53/100 | First seen |
| IP | 77.91.100.175 | High | Score 58/100 | First seen |
| SHA1 | 3a7fb23fc94d7db1db0cfa46dcef2f573de84526 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…