#CryptoScamAwareness A sophisticated cybercrime campaign dubbed "GreedyBear" has stolen over $1 million in cryptocurrency by employing a triple threat of attack types. This campaign involves
- Malicious Browser Extensions: Over 150 fake extensions were published on the Firefox browser marketplace, impersonating popular crypto wallets like MetaMask, TronLink, Exodus, and Rabby Wallet. These extensions use an "Extension Hollowing" technique, where attackers create legitimate extensions initially to bypass security checks, then later make them malicious.
- Crypto-Themed Malware: Almost 500 malware samples were identified, including credential stealers like LummaStealer and ransomware variants designed to demand crypto payments. This malware is often distributed through Russian websites offering cracked or pirated software.
- Scam Websites: A network of fake websites poses as crypto-related products and services, tricking users into divulging sensitive information. These sites appear as legitimate product landing pages, advertising digital wallets, hardware devices, or wallet repair services.
The GreedyBear group has redefined industrial-scale crypto theft by combining these attack vectors, showcasing a sophisticated approach to targeting crypto users. According to Tuval Admoni, a researcher at Koi Security, this group has "stopped thinking small" and is now deploying complex scams to maximize their gains. The campaign's success highlights the need for stronger security measures and user vigilance
The GreedyBear campaign is a sophisticated cybercrime operation that's stolen over $1 million in cryptocurrency using three main attack vectors:
- Malicious Browser Extensions: Over 150 fake extensions were published on the Firefox browser marketplace, impersonating popular crypto wallets like MetaMask, TronLink, Exodus, and Rabby Wallet. These extensions use an "Extension Hollowing" technique, where attackers create legitimate extensions initially to bypass security checks, then later make them malicious.
- Crypto-Themed Malware: Almost 500 malware samples were identified, including credential stealers like LummaStealer and ransomware variants designed to demand crypto payments. Most of the malware is distributed through Russian websites offering cracked or pirated software.
- Scam Websites: A network of fake websites poses as crypto-related products and services, appearing as slick, fake product landing pages advertising digital wallets, hardware devices, or wallet repair services. One server acts as a central hub for command-and-control, credential collection, ransomware coordination, and scam websites, allowing the attackers to streamline operations across multiple channels.