GreedyBear Hackers Steal $1M+ in ‘Industrial Scale’ Crypto Theft Using Multi-Vector Attack

Key Points

1. GreedyBear utilized 150 weaponized Firefox extensions, nearly 500 malicious executables, and phishing websites to steal over $1 million.

2. The group employed 'Extension Hollowing,' a technique involving the creation of seemingly legitimate extensions before weaponizing them with malicious code.

3. The operation evolved from the 'Foxy Wallet' campaign, expanding from 40 to over 150 malicious extensions.

4. The attack targeted popular crypto wallets like MetaMask, TronLink, Exodus, and Rabby Wallet, capturing credentials directly from user input fields.

5. Koi Security exposed the campaign, highlighting its scale and coordination in crypto-focused cybercrime.