GreedyBear Steals $1M in Crypto Using 150+ Malicious Firefox Wallet Extensions

Aug 8, 2025

A newly discovered campaign dubbed GreedyBear has leveraged over 150 malicious extensions to the Firefox marketplace that are designed to impersonate popular cryptocurrency wallets and steal more than $1 million in digital assets.
The published browser add-ons masquerade as MetaMask, TronLink, Exodus, and Rabby Wallet, among others, Koi Security researcher Tuval Admoni said.
What makes the

Get Free Report & Network Analysis

Please check your email for the free report.