PhishingPublished 8 Aug 2025

GreedyBear Scam: 150 Fake Crypto Wallet Extensions Found on Firefox Marketplace

Source Reddit InfoSec News

Description

GreedyBear Scam: 150 Fake Crypto Wallet Extensions Found on Firefox Marketplace Source: https://hackread.com/greedybear-fake-crypto-wallet-extensions-firefox-marketplace/

Impact

For European organizations, the impact of the GreedyBear Scam can be multifaceted. Individual employees using compromised crypto wallet extensions may suffer financial losses, which can indirectly affect organizational security posture if corporate funds or assets are involved. Organizations with employees engaged in cryptocurrency transactions or holding crypto assets are at risk of credential theft and subsequent unauthorized access to corporate or personal wallets. Additionally, if attackers gain access to corporate cryptocurrency wallets, this could lead to direct financial theft and reputational damage. The scam also undermines trust in browser marketplaces and crypto wallet extensions, potentially affecting organizations involved in blockchain, fintech, or cryptocurrency sectors. Furthermore, phishing attacks can serve as entry points for broader cyber intrusions if attackers leverage stolen credentials to escalate privileges or deploy malware within corporate networks. The medium severity rating reflects the significant potential for financial and data loss, although exploitation requires user interaction and installation of malicious extensions.

Defensive guidance

European organizations should implement targeted mitigation strategies beyond generic advice: 1) Enforce strict browser extension policies via endpoint management solutions to whitelist only verified and necessary extensions, blocking all others. 2) Educate employees specifically about the risks of installing crypto wallet extensions from unverified sources, emphasizing verification of publisher identity and reviews. 3) Monitor network traffic for suspicious activity indicative of phishing or data exfiltration related to browser extensions. 4) Encourage the use of hardware wallets or official desktop/mobile wallet applications over browser extensions for managing cryptocurrency assets. 5) Collaborate with IT security teams to regularly audit installed browser extensions across corporate devices and promptly remove any unapproved or suspicious ones. 6) Stay updated with threat intelligence feeds and browser marketplace announcements to quickly identify and respond to newly discovered malicious extensions. 7) Implement multi-factor authentication (MFA) on all cryptocurrency accounts to reduce the impact of credential theft. 8) Consider deploying browser security solutions that can detect and block phishing attempts and malicious extension behaviors in real-time.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 Aug 2025, 11:48 UTC

Technical details

References

Community reviews