# Forty malicious Firefox add-ons harvested wallet keys, and nine of them started as sports-score tools

Socket linked 77 extension identities to one campaign running since March, with theft code arriving in later updates that browser review had already approved.

- Published: 2026-08-26T05:49:32.350Z
- Canonical: https://polylog.news/crypto/2026-08-26/forty-malicious-firefox-add-ons-harvested-wallet-keys-and-ni
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/firefox-crypto-wallet-malware-hid-behind-nine-sports-add-ons-turning-routine-updates-into-a-key-rotation-trap/), [Socket](https://socket.dev/blog/firefox-crypto-wallet-theft), [The Hacker News](https://thehackernews.com/2026/08/40-malicious-firefox-extensions-pose-as.html)

Socket Threat Research linked 77 Firefox extension identities through shared code and infrastructure and confirmed 40 of them as malicious, in a campaign it says has run since at least March. The confirmed add-ons impersonate the wallets OK…

This story is for subscribers. Read it in full at https://polylog.news/crypto/2026-08-26/forty-malicious-firefox-add-ons-harvested-wallet-keys-and-ni (subscription information: https://polylog.news/pricing).