GreedyBear Malware: 650+ Fake Wallet Extensions Stole $1M in Crypto

The cybersecurity community is sounding alarms about the GreedyBear malware campaign, which has successfully stolen over $1 million in cryptocurrency assets through an elaborate scheme involving hundreds of malicious browser extensions. According to security researchers, the operation represents one of the most sophisticated crypto-focused attacks seen to date.

Technical Analysis:
The attackers created over 650 counterfeit Firefox extensions designed to mimic legitimate cryptocurrency wallets including MetaMask, Phantom, and Trust Wallet. These malicious extensions were distributed through both official and third-party browser extension marketplaces, often using fake developer accounts and manipulated ratings to appear legitimate.

Once installed, the extensions presented users with interfaces nearly identical to genuine wallet applications. However, they contained hidden functionality that:

• Intercepted and exfiltrated private keys and seed phrases
• Modified transaction details to redirect funds to attacker-controlled addresses
• Implemented sophisticated web injection to alter displayed balances

The campaign employed multiple evasion techniques, including:

• Delayed malicious payload activation (up to 2 weeks post-installation)
• Dynamic C2 infrastructure using decentralized domains
• Code obfuscation mimicking legitimate extension updates

Impact and Detection:
Security firm Koi Security estimates the campaign remained active for at least 5 months before detection, with peak activity coinciding with major crypto market movements. The attackers specifically targeted:

• Retail investors using browser-based wallet solutions
• Users searching for wallet alternatives during service outages
• Participants in cryptocurrency airdrops and NFT mints

Mitigation Recommendations:

1. Verify extension developer identities through multiple sources
2. Monitor for unusual transaction confirmation behaviors
3. Implement hardware wallet solutions for significant holdings
4. Regularly audit installed browser extensions
5. Use dedicated browser profiles for crypto activities

The GreedyBear operation highlights the growing sophistication of supply-chain attacks in the cryptocurrency space, where attackers increasingly target the tools and infrastructure supporting digital asset management rather than attempting direct blockchain compromises.