Researchers found 40 malicious Firefox extensions pretending to be popular Web3 wallet products (like OKX, Rabby Wallet, and TronLink) to steal crypto wallet secrets. The extensions trick users into installing them, then capture recovery phrases/private keys and send them to attacker-controlled online infrastructure.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You open Firefox and see this: “Install Rabby Wallet for Firefox to manage your Web3 assets.” Looks legit, right? Researchers just found 40 Firefox extensions in a campaign called Offside Wallet Theft Factory, copying OKX, Rabby Wallet, and TronLink to steal crypto. They ask you to import your recovery phrase, then silently ship it out through Cloudflare Workers and other cloud services. Here’s the nasty twist: some started as harmless sports-score or utility add-ons. After a few updates, that “NBA scores” extension quietly turns into a wallet tool, suddenly asking for seed phrases or clipboard access while still under the same Firefox ID. Your move: if any browser extension, Firefox, Chrome, anything, ever asks for your wallet recovery phrase or private key, stop and close it. That request alone is your cue to uninstall and report it.
Researchers found a campaign of malicious Firefox add-ons that look like legitimate crypto wallets, VPNs, or utilities but are designed to trick people into entering wallet recovery phrases or exposing credentials. The add-ons can switch from harmless decoys (like a notepad or sports scores) to a…
Kaspersky reported that Iran-linked APT Mirage Kitten approached software engineers on LinkedIn using fake recruiter personas and sent “coding challenges” that were actually trojanized projects. The lure used legitimate-looking cloud hosting (Amazon S3) and even instructed victims not to use AI…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
An Iran-linked espionage group contacted developers and other tech specialists with fake job offers on LinkedIn and similar platforms. Victims were pushed to quickly download and run “coding challenges” that secretly installed new malware, giving attackers remote access and long-term persistence.…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Researchers say a North Korea-aligned group is targeting Web3 and crypto professionals with fake recruiter outreach and “mandatory” online skill tests. During the test, victims are tricked into copying a terminal command to “fix” a camera/mic error, which installs remote-access malware and can lead…
