A Russian Hacking Group Is Using Fake Versions of MetaMask to Steal $1M in Crypto

Key Points

1. GreedyBear employs fake versions of popular crypto wallets like MetaMask, Exodus, Rabby Wallet, and TronLink to steal cryptocurrency.

2. The group uses 'Extension Hollowing' to bypass security measures by initially uploading non-malicious versions of extensions before replacing them with malicious ones.

3. The Firefox extension campaign primarily targets global and English-speaking victims, while malicious executables focus on Russian-speaking victims.

4. Koi Security's research indicates GreedyBear operates with centralized control, suggesting organized cybercrime rather than state-sponsored activity.

5. The group has also created fake hardware wallet websites to steal payment information from victims.