Malicious Campaign Nets Over $1 Million in Crypto Theft Through Diverse Attack Methods

According to Cointelegraph, a sophisticated malicious campaign has successfully stolen more than $1 million in cryptocurrency by employing a combination of attack strategies across numerous browser extensions, websites, and malware. This operation, identified by cybersecurity firm Koi Security, has been attributed to a group named “GreedyBear,” which has been described as having “redefined industrial-scale crypto theft.” Koi Security researcher Tuval Admoni highlighted the group's unique approach, noting that while most cybercriminal groups tend to specialize in one type of attack, GreedyBear has effectively utilized multiple methods simultaneously. This includes the deployment of over 150 fake crypto browser extensions, which have been used to impersonate popular crypto wallets such as MetaMask, TronLink, Exodus, and Rabby Wallet. These extensions employ an “Extension Hollowing” technique, initially appearing legitimate to pass marketplace checks before becoming malicious. This strategy allows the group to capture wallet credentials directly from user input fields within fake wallet interfaces. In addition to browser extensions, GreedyBear has also focused on crypto-themed malware, with Koi Security uncovering nearly 500 samples. These include credential stealers like LummaStealer, which target crypto wallet information, and ransomware variants such as Luca Stealer, designed to demand cryptocurrency payments. The malware is primarily distributed through Russian websites offering cracked or pirated software, further complicating efforts to combat these threats. The third component of GreedyBear’s attack strategy involves a network of scam websites posing as legitimate crypto-related products and services. These sites are not typical phishing pages but rather sophisticated fake product landing pages advertising digital wallets, hardware devices, or wallet repair services. A single server acts as a central hub for command-and-control, credential collection, ransomware coordination, and scam websites, streamlining operations across multiple channels. The campaign has also shown signs of utilizing AI-generated code, enabling rapid scaling and diversification of crypto-targeting attacks. This represents a new evolution in crypto-focused cybercrime, with Admoni warning that such attacks are becoming the new normal. The campaign underscores the need for stronger vetting by browser vendors, developer transparency, and increased user vigilance to combat these sophisticated threats.