Researchers found 40 malicious Firefox extensions pretending to be popular Web3 wallet products (like OKX, Rabby Wallet, and TronLink) to steal crypto wallet secrets. The extensions trick users into installing them, then capture recovery phrases/private keys and send them to attacker-controlled online infrastructure.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You open Firefox and see this: “Install Rabby Wallet for Firefox to manage your Web3 assets.” Looks legit, right? Researchers just found 40 Firefox extensions in a campaign called Offside Wallet Theft Factory, copying OKX, Rabby Wallet, and TronLink to steal crypto. They ask you to import your recovery phrase, then silently ship it out through Cloudflare Workers and other cloud services. Here’s the nasty twist: some started as harmless sports-score or utility add-ons. After a few updates, that “NBA scores” extension quietly turns into a wallet tool, suddenly asking for seed phrases or clipboard access while still under the same Firefox ID. Your move: if any browser extension, Firefox, Chrome, anything, ever asks for your wallet recovery phrase or private key, stop and close it. That request alone is your cue to uninstall and report it.
Researchers say a North Korea-aligned group is targeting Web3 and crypto professionals with fake recruiter outreach and “mandatory” online skill tests. During the test, victims are tricked into copying a terminal command to “fix” a camera/mic error, which installs remote-access malware and can lead…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Researchers report Mirage Kitten (an espionage-focused threat group) targeted organizations in the Middle East and Africa using highly tailored spear‑phishing. The lures included recruitment-themed messages impersonating trusted brands/hiring sites and fake videoconferencing pages that redirected…
Researchers linked DigiCert’s April 2026 breach to a GoldenEyeDog sub-group that tricked support staff into running a malicious file delivered through a customer support chat. The attackers then abused DigiCert’s support portal features to intercept EV code-signing certificate “initialization…
Researchers say criminals are cloning popular GitHub repositories for AI tools and developer resources, then quietly changing installation instructions to deliver an infostealer. The pages look legitimate (including original contributors), which lures developers into downloading and running a ZIP…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
