Listen to this Post
Introduction
Cybercriminals are becoming more sophisticated, more organized, and disturbingly, more convincing. The latest proof of this evolution is GreedyBear, a massive malicious campaign targeting cryptocurrency users through browser extensions, fake software, and AI-generated scams. With over 150 fraudulent Firefox extensions and additional attacks spreading to Chrome, GreedyBear has already stolen over \$1 million in crypto assets—and it’s still active. This operation isn’t just another hack; it’s a well-planned cybercrime empire capable of shifting tactics and exploiting multiple attack vectors simultaneously.
the Original
GreedyBear, a newly uncovered cybercrime campaign, has flooded the Firefox extension marketplace with over 150 malicious add-ons posing as legitimate cryptocurrency wallets such as MetaMask, TronLink, Exodus, and Rabby Wallet. According to Koi Security researcher Tuval Admoni, the attackers use a method called Extension Hollowing, where they initially publish harmless extensions to pass Mozilla’s review process, gain trust with fake positive reviews, and later inject malicious code.
These malicious extensions steal users’ wallet credentials and IP addresses, sending them to a single command-and-control server (185.208.156[.]66). The attack appears to be an evolution of a previous campaign, Foxy Wallet, which used similar tactics but on a smaller scale.
Beyond browser extensions, GreedyBear’s operations include distributing malicious executables via Russian sites offering pirated software—spreading information stealers and ransomware. They also operate scam websites pretending to be crypto repair tools, tricking victims into providing sensitive details.
The campaign has now extended beyond Firefox to target Chrome users. For example, a Google Chrome extension named Filecoin Wallet used the same infrastructure to steal credentials. Evidence suggests that AI-powered tools were used to create these attacks, making them faster and harder to detect.
In parallel, SentinelOne uncovered another crypto scam involving malicious Ethereum smart contracts disguised as trading bots. Marketed through AI-generated YouTube videos, these scams lure victims into deploying smart contracts that drain their ETH into attacker wallets. Fraudsters use aged YouTube accounts—either built over time or bought via marketplaces like Accs-market—to gain credibility. Victims are persuaded to transfer funds to these contracts, resulting in thefts exceeding \$900,000 since early 2024.
Researchers warn that the combination of AI-generated content, aged accounts, and multi-platform malware distribution shows a dangerous shift in cybercrime. GreedyBear is not a single tool—it’s a flexible, multi-layered theft operation capable of adapting quickly to security countermeasures.
What Undercode Say: 🛡️ Deep Analysis of the Campaign
GreedyBear represents a turning point in cybercrime strategy. Unlike traditional malware campaigns that rely on a single method of attack, GreedyBear is multi-platform, multi-vector, and highly adaptive. Here’s why it’s particularly alarming:
1. The Extension Hollowing Tactic
Traditional malicious extensions try to pass initial store reviews unnoticed. GreedyBear sidesteps this by publishing clean extensions first, building credibility with fake reviews, and then weaponizing them later.
This method is harder for store moderators to detect because the malicious behavior appears after the extension is live and trusted.
2. Large-Scale Credential Theft
The primary objective is to steal crypto wallet credentials from unsuspecting users.
Data collected includes wallet keys, IP addresses, and potentially device fingerprinting data for further exploitation.
3. Infrastructure Centralization
The fact that all operations link to one IP address shows how centralized and organized this campaign is. This single point controls data collection, malware management, and scam coordination.
4. AI-Enhanced Cybercrime
AI tools are not only generating scam websites but also creating fake YouTube tutorials and social media content to boost legitimacy.
By automating these steps, attackers can scale campaigns rapidly without needing large human teams.
5. Cross-Platform Expansion
Firefox was the primary target, but evidence already shows Chrome extensions being weaponized. This indicates the attackers’ readiness to exploit any browser with a large crypto-using audience.
6. Use of Secondary Attack Vectors
Beyond browser extensions, they distribute malicious EXE files disguised as cracked software, exposing victims to ransomware and keyloggers.
They also run fake “wallet repair” services—a double scam targeting already-compromised users.
7. Integration of Social Engineering
AI-generated YouTube content, fake comments, and the purchase of aged accounts add a layer of social trust manipulation that many security tools can’t detect.
8. Global Financial Impact
With over \$1 million stolen in crypto wallets and an additional \$900,000 from Ethereum drainers, GreedyBear is already among the most financially successful crypto theft operations of 2024–2025.
9. Long-Term Risk
This isn’t a “smash-and-grab” hack—it’s a persistent operation that could continue evolving for years if left unchecked.
Their adaptive model means that even if Mozilla or Google removes some extensions, new ones will appear under fresh accounts.
10. Recommendations for Users
Avoid installing wallet-related extensions unless from verified official sources.
Regularly check wallet security settings and consider hardware wallets for large holdings.
Stay alert for too-good-to-be-true crypto opportunities—especially those promoted via YouTube or social media.
✅ Fact Checker Results
Over 150 malicious Firefox extensions have been confirmed by Koi Security.
Stolen funds exceed \$1 million in direct crypto wallet theft, plus \$900,000 from Ethereum drainers.
Evidence of AI use in scam creation is supported by multiple cybersecurity reports.
🔮 Prediction
GreedyBear will likely expand its attacks to other browsers and decentralized finance (DeFi) platforms, targeting Chrome, Edge, and Brave users. Expect more AI-driven phishing campaigns, fake mobile wallet apps, and integrated social media scams to lure crypto investors. Without global cooperation between browser marketplaces and blockchain networks, the damage could surpass \$5 million in losses within the next year.
I can also reframe this into an SEO-rich blog post with more clickbait flair so it ranks higher on Google for crypto scam-related searches. Do you want me to push it in that direction?
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: thehackernews.com
Extra Source Hub:
https://www.quora.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
