The Russian hacking group 'GreedyBear' has been revealed to have stolen $1 million (approximately 1.3 billion won) in just 5 weeks using fake cryptocurrency wallet extensions. According to a report released by cybersecurity company CoinSecurity on the 11th (local time), they operated 150 malicious Firefox extensions and distributed forgeries of major cryptocurrency wallets such as MetaMask, Exodus, and Rabby Wallet.
Of particular note is the 'extension hollowing' technique they used. Initially, they uploaded a normal extension to the browser store and then updated it with malicious code to bypass security verification. They used a meticulous method that even created fake reviews to increase credibility.
Compared to their previous campaign in April-July, which operated only 40 extensions, GreedyBear has significantly expanded its scale. In addition to browser extensions, they are conducting multi-pronged attacks through over 500 malicious executable files and dozens of phishing websites.
Interestingly, all attack domains are connected to a single IP address (185.208.156.66), showing a centralized operational structure. Experts are analyzing this as organized crime aimed at profit rather than state-sponsored activity.
Edan Dardicman, CTO of CoinSecurity, warned that "the Firefox campaign primarily targets English-speaking users, which means Korean investors using global DeFi platforms could also become targets."
Experts recommend installing only extensions from verified developers and using hardware wallets when holding large assets. They also emphasized purchasing hardware wallets only from official manufacturer websites, as GreedyBear is also forging hardware wallet sales sites.
