Crypto Scam Group GreedyBear Steals Over $1 Million Using Fake Extensions and Malware

Crypto scam group GreedyBear steals over $1m using fake extensions and malware

Summary:
A cryptocurrency scam group known as GreedyBear has reportedly stolen over $1 million through a sophisticated operation that combines malicious browser extensions, malware, and scam websites. This coordinated effort marks a significant escalation in crypto-related cybercrime.

Key Takeaways:

GreedyBear has stolen more than $1 million by utilizing combined attack methods including fake extensions and malware.
The group has launched over 650 malicious tools targeting cryptocurrency wallet users.
GreedyBear's operations include scam websites that impersonate legitimate crypto products and services.
The group's infrastructure is centralized to facilitate efficient operations and data management.
The use of AI-generated elements in their schemes allows for faster attacks and evasion of detection.

Introduction to GreedyBear's Operations

A cryptocurrency scam group named “GreedyBear” has reportedly stolen more than $1 million. Researchers characterize this as an industrial-scale operation that employs a combination of malicious browser extensions, malware, and scam websites to achieve its goals.

Unprecedented Scale of Crypto Theft

According to Tuval Admoni, a researcher at Koi Security, GreedyBear has "redefined industrial-scale crypto theft." Unlike many cybercriminal organizations that focus on a single type of attack—such as phishing, ransomware, or fake extensions—this group employs all three tactics simultaneously at a large scale.

Recent findings from blockchain security firm PeckShield highlight a worrying surge in crypto crime, with criminals stealing approximately $142 million in July alone across 17 significant incidents.

Overview of GreedyBear's Campaign

Koi Security's investigation has revealed that GreedyBear's current campaign has implemented more than 650 malicious tools that particularly target cryptocurrency wallet users. This is an escalation from the group’s previous campaign, called “Foxy Wallet,” which exposed 40 malicious Firefox extensions in July.

Techniques Used by GreedyBear

The group employs a technique referred to as “Extension Hollowing” to evade marketplace checks and gain user trust. They begin by publishing seemingly harmless Firefox extensions—like link sanitizers or video downloaders—under newly created publisher accounts. These extensions are artificially enhanced with positive reviews before being converted into tools that impersonate popular wallets like MetaMask, TronLink, Exodus, and Rabby Wallet. Once these extensions are active, they gather users' credentials from input fields and send them to GreedyBear’s command-and-control server.

Malware Operations and Broader Reach

Beyond browser extensions, the research uncovered almost 500 malicious Windows executables connected to GreedyBear's infrastructure. These files demonstrate a range of malware types, including credential stealers such as LummaStealer, ransomware resembling Luca Stealer, and general-purpose trojans likely intended as loaders for additional payloads.

Many of these malware samples are found on Russian-language websites that distribute cracked, pirated, or modified software. This distribution method broadens the group's access to less security-conscious users and allows them to infect a wider audience beyond those specifically involved in cryptocurrency.

The Role of Scam Websites

Running parallel to their malware efforts, GreedyBear also manages a network of scam websites that impersonate legitimate cryptocurrency products and services. These sites are cleverly designed to collect sensitive information from unsuspecting users.

Koi Security discovered fake landing pages that advertised hardware wallets and fraudulent wallet-repair services claiming to fix popular brands like Trezor. Other sites promoted counterfeit digital wallets or crypto utilities, all boasting professional designs. Unlike traditional phishing sites that mimic exchange login pages, these scams are disguised as product showcases or support services. They entice users to provide wallet recovery phrases, private keys, payment information, or other sensitive data, which are then stolen for subsequent fraud or theft.

Conclusion and Implications

Koi’s investigation revealed that almost all domains linked to GreedyBear’s extensions, malware, and scam websites are connected to a single IP address—185.208.156.66. This centralized server acts as the command-and-control hub for the operation, managing credentials, coordinating ransomware activities, and serving fraudulent websites. By centralizing their operations, the group can efficiently monitor victims, modify payloads, and quickly distribute stolen data.

Admoni noted the presence of “AI-generated artifacts” in the campaign’s code, indicating that the use of advanced technologies makes it easier for attackers to enhance their operations, diversify their payloads, and evade detection. “This isn’t a passing trend—it’s the new normal,” he stated. As attackers increasingly utilize advanced AI, it is critical for defenders to employ equally sophisticated security tools and intelligence to combat these threats.