Bitcoin 
Ethereum 
Tether 
BNB 
Solana 
XRP 
USDC 
Lido Staked Ether 
Cardano 
Avalanche 
Fake Versions of MetaMask exposed as part of a major hacking operation by the Russian cybercrime group GreedyBear.
According to Koi Security, the group has stolen over $1 million in the past five weeks, primarily by distributing malicious Firefox extensions disguised as legitimate crypto wallets. Victims include international and English-speaking crypto users, targeted through sophisticated deception tactics.
The hackers created fake versions of widely used wallets such as MetaMask, Exodus, Rabby Wallet, and TronLink. They used a method called Extension Hollowing, uploading harmless versions of extensions to pass security checks, then later updating them with malicious code. Fake reviews boosted their credibility, tricking unsuspecting users into downloading them. Once installed, these extensions harvested wallet credentials, enabling direct theft of funds.
Fake Versions of MetaMask exposed as a high-revenue attack vector
Koi Security’s findings reveal that GreedyBear’s Firefox extension campaign generated most of the $1 million in stolen funds. This approach is an evolution of their previous operation, which ran between April and July and involved only 40 malicious extensions. The latest campaign used 150 weaponized extensions, significantly expanding their attack scale.
Alongside the Firefox operation, GreedyBear deployed nearly 500 malicious Windows executables. These were hosted on Russian sites offering pirated or repacked software. This malware arsenal included credential stealers, ransomware, and trojans. Koi Security believes this demonstrates the group’s flexible and industrialized malware distribution pipeline.
ANOTHER MUST-READ ON ICN.LIVE: Gold Futures Record surges as tariffs shake up safe-haven assets landscape
Growing scale of international crypto wallet attacks
The combination of fake extensions, phishing sites, and malware makes GreedyBear a formidable threat to crypto security. Their tactics bypass standard browser marketplace protections and exploit user trust through deceptive ratings and reviews. The exposure of fake versions of MetaMask and other wallets underscores the urgent need for heightened user awareness and stricter extension vetting processes.
Crypto users are urged to verify wallet downloads only from official sources, avoid browser extensions without a strong track record, and remain vigilant about extension permissions. Security experts also recommend keeping security software updated and regularly monitoring wallet activity.
