GreedyBear: 150 Fake Crypto Wallet Extensions Explained

Video transcript

Koi Security found 150 Firefox add-ons that passed review as harmless tools, then became fake MetaMask, TronLink and Rabby wallets.

Koi calls it Extension Hollowing. Upload harmless add-ons that pass review, add fake positive reviews, swap in wallet names and logos, then push a malicious update.

The update added a keylogger that sent wallet credentials to the group's server. Koi's research put the theft at about one million dollars.

Koi Security's Tuval Admoni said the operators build legitimate-seeming extension portfolios first, then weaponize them later when nobody's watching.

Mozilla deployed a crypto drainer detection system in June 2025, and these still got through. The malicious code arrived after review.

Wallet teams should link official listings from their site, report copies using their brand, publish extension IDs, say when they will never ask for a seed phrase, and keep a recovery guide ready.

For users, Mozilla's advice is short: only use the extension your wallet's own website links to. Ratings are not proof. GreedyBear faked its reviews.

A pentest cannot remove a fake from a store. It can show what a malicious version of your extension could reach. Guardian's Browser Extension Pentest covers permissions, content scripts, internal messaging, key storage, signing flows and supply chain.

Read the full article, or talk to Guardian about what a bad version of your extension could take.

Cyberhaven and Trust Wallet were real extensions, hijacked through their publishing access. GreedyBear built fake ones, and got them approved first.

BleepingComputer reported the campaign on August 7, 2025, from research by Koi Security. It counted 150 malicious add-ons in Mozilla's Firefox store; The Hacker News said over 150.

They posed as MetaMask, TronLink and Rabby. The trick was timing: the add-ons turned malicious after review.

What Happened

The add-ons were one part of a wider operation, BleepingComputer reported:

• 150 malicious Firefox add-ons posing as crypto wallets.
• 500 distinct malware executables spread through Russian-speaking pirated software sites.
• Websites impersonating Trezor, Jupiter Wallet and wallet repair services.
• One command-and-control IP address, 185.208.156.66, shared by these sites.

Koi reported its findings to Mozilla, and the add-ons were removed from the store.

Koi also found a Chrome extension, "Filecoin Wallet," using the same theft logic and IP address. Koi took this as a sign the group is exploring the Chrome Web Store.

GreedyBear is assessed to be an extension of an earlier campaign, Foxy Wallet, with at least 40 malicious Firefox add-ons, The Hacker News reported.

How the Attack Worked

Koi calls the technique Extension Hollowing, The Hacker News reported. It runs in stages:

1. Create a publisher account on the add-on store.
2. Upload harmless add-ons with no real function, which pass review.
3. Build credibility with fake positive reviews.
4. Strip the original branding and add new names and logos.
5. Push an update that adds the malicious code.

Koi Security's Tuval Admoni said the operators "build legitimate-seeming extension portfolios first, then weaponize them later when nobody's watching."

What the code stole

Koi's analysis, as BleepingComputer reported it:

• A keylogger captured input from form fields and displayed popups.
• Captured wallet credentials went to a server the group controls.
• At startup, each add-on also sent the victim's external IP address.

Koi also saw signs of AI-generated code, which it said makes such campaigns easier to scale and harder to detect.

Timeline and Impact

BleepingComputer, reporting Koi's research, put the theft at an estimated $1,000,000. The Hacker News said more than $1 million.

Neither report gives an install count or a number of victims.

The add-ons got through even though Mozilla had deployed a system to detect crypto drainer add-ons in June 2025, BleepingComputer noted.

That system scores each submitted wallet extension for risk. Past a threshold, human reviewers take a deeper look, Mozilla says.

"It's a constant cat and mouse game, as developers try to work around our detection methods," said Mozilla's Andreas Wagner.

What It Shows for Wallet Extensions

Review checks a moment, not a lifetime

Each add-on passed review as something harmless. The malicious code arrived later, as an update.

The same pattern has hit code editors. See malicious VS Code extensions, where sleeper extensions turned malicious after upload.

Ratings can be faked

Fake positive reviews made the listings look trusted. A rating says nothing about who published an extension.

Your brand is attack surface

A wallet team can ship a clean extension and still lose users to a copy. Whatever they type goes to the fake, under your name.

All three ran through the update path

Cyberhaven lost a publisher account. Trust Wallet lost a store API key. GreedyBear owned its accounts from the start.

Checks for wallet teams

• Link each official store listing from your website and docs.
• Search every store for listings using your name or logo, and report them.
• Publish your extension IDs, so users and IT teams can verify an install.
• Tell users when your extension will ask for a seed phrase, and when it never will.
• Keep a recovery guide ready for users who typed a seed into a fake.

For users, Mozilla's advice is short: "Check your crypto wallet's website to see if they have an official extension, and only use the one they link to."

Anyone who already entered a seed phrase into a fake should follow what to do when a wallet is drained.

How Guardian Tests This Surface

A pentest of your own extension cannot remove a fake from a store. It can show how much a malicious version of your extension could reach.

Guardian's Browser Extension Pentest tests what a hostile site can extract and what a bad update could do. It covers six areas:

• Permissions and manifest: how far a malicious version could go.
• Content scripts: what a hostile site can reach through them.
• Internal messaging: whether a page can hit a privileged handler.
• Key and session storage: what is readable while unlocked.
• Signing flows: whether what gets signed matches what the user approved.
• Supply chain: bundled dependencies, build integrity, and who can publish a store update.

Source code is effectively required: a store download cannot confirm every path was reviewed.

Frequently Asked Questions

What is GreedyBear?

GreedyBear is the name given to a campaign Koi Security reported in August 2025: 150 malicious Firefox add-ons posing as MetaMask, TronLink and Rabby wallets. The same infrastructure also served malware and scam websites.

How did the GreedyBear extensions get past Firefox review?

They were uploaded in harmless form, collected fake positive reviews, and were later rebranded and updated with malicious code. Koi Security calls the technique Extension Hollowing, The Hacker News reported.

How much did GreedyBear steal?

Koi Security's research put it at about $1 million: an estimated $1,000,000 per BleepingComputer, and more than $1 million per The Hacker News. Neither report gives an install count or a number of victims.

How can users avoid fake wallet extensions?

Install only the extension your wallet's official website links to, as Mozilla advises. Ratings and reviews are not proof, since GreedyBear's listings used fake positive reviews.

Sources

• BleepingComputer: Wave of 150 crypto-draining extensions hits Firefox add-on store (August 7, 2025)
• The Hacker News: GreedyBear Steals $1M in Crypto Using 150+ Malicious Firefox Wallet Extensions (August 8, 2025)
• Mozilla Add-ons Blog: Crypto wallet scams, thwarting a new threat (May 30, 2025)
• BleepingComputer: Mozilla launches new system to detect Firefox crypto drainer add-ons (June 3, 2025)
• Guardian: Browser Extension Pentest