A coordinated campaign targeting cryptocurrency users through the Firefox browser has been uncovered, with 40 malicious extensions confirmed to be stealing wallet credentials and recovery phrases directly from victims.

Security firm Socket identified 77 interconnected browser extensions in total, 40 of which contained code designed to harvest sensitive wallet information such as seed phrases and private keys. The remaining 37 were disguised as unrelated utilities while actually displaying live sports scores, sharing a single hardcoded credential for a legitimate sports data provider.

The campaign, which Socket has named the Offside Wallet Theft Factory, operated from at least March 9 through August 3, according to Mozilla signing…