# Browser extension cryptocurrency theft campaigns > Live situation record from CLSTR: https://clstr.news/situations/browser-extension-cryptocurrency-theft-campaigns > Updated: 2026-08-31T00:00:00.000Z. Sources: 6. Developments: 2. Security researchers have identified large-scale malware campaigns utilizing malicious browser extensions to facilitate cryptocurrency theft. Initial reports identified the ‘Offside Wallet Theft Factory’ campaign, which involved approximately 40 malicious Firefox extensions. These extensions masqueraded as legitimate Web3 products, such as OKX and TronLink, to exfiltrate recovery phrases and private keys. The campaign, active since March 2026, utilized Cloudflare Workers and Supabase projects to manage data exfiltration and phishing pages. Subsequent findings expanded the scope to include a supply chain campaign targeting Google Chrome and Microsoft Edge users. This operation involved both newly created extensions and those acquired from legitimate publishers. In one instance, a hijacked extension reached approximately 70,000 Chrome users and 10,000 Edge users. The malware in these campaigns is designed to hijack ‘Connect Wallet’ and ‘Swap’ buttons to drain assets across networks including EVM, Solana, and Tron. It also possesses the capability to replace hardware wallet websites with phishing pages, steal session tokens from major exchanges like Coinbase and Binance, and bypass security measures by removing Content Security Policy (CSP) headers. ## Timeline ### 2026-08-31: Browser extensions weaponized in cryptocurrency theft campaign A supply chain attack involving 19 Chrome and Edge extensions has been uncovered, targeting cryptocurrency users to steal funds, credentials, and session tokens via malicious updates. 6 sources. https://clstr.news/cluster/browser-extensions-weaponized-in-cryptocurrency-theft-campaign ### 2026-08-20: Firefox extensions identified in cryptocurrency wallet theft campaign A campaign called ‘Offside Wallet Theft Factory’ uses 40 malicious Firefox extensions to steal cryptocurrency recovery phrases and private keys by posing as legitimate Web3 products. 2 sources. https://clstr.news/cluster/firefox-extensions-identified-in-cryptocurrency-wallet-theft-campaign --- Cite as: Browser extension cryptocurrency theft campaigns. CLSTR, https://clstr.news/situations/browser-extension-cryptocurrency-theft-campaigns