Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The GreedyBear attack group has launched a massive crypto theft operation, utilizing 150 weaponized Firefox extensions, nearly 500 malicious executables, and numerous phishing websites. Their tactics include Extension Hollowing to bypass marketplace security, distributing various malware families, and creating scam sites masquerading as crypto products. The campaign's infrastructure is consolidated to a single IP address, suggesting a centralized backend. The group has expanded from its earlier Foxy Wallet campaign and shows signs of potential growth beyond Firefox. The attackers are leveraging AI to scale their operations, making it challenging for traditional security measures to keep up. The campaign has reportedly stolen over $1 million from victims.

The GreedyBear attack group has orchestrated a large-scale, multifaceted crypto theft campaign leveraging a diverse arsenal of over 650 attack tools, including 150 weaponized Firefox browser extensions, nearly 500 malicious executables, and numerous phishing websites. Their primary tactic, Extension Hollowing, allows them to bypass Firefox marketplace security by injecting malicious code into legitimate extensions, thereby evading detection and facilitating widespread distribution. The campaign infrastructure is notably centralized, with all malicious activities routed through a single IP address, indicating a streamlined backend command and control setup. GreedyBear's operations have evolved from their earlier Foxy Wallet campaign, expanding their scope and potentially targeting platforms beyond Firefox in the near future. The attackers employ artificial intelligence techniques to automate and scale their operations, complicating detection and mitigation efforts by traditional security tools. The campaign encompasses multiple malware families, including Luca Stealer and Lummastealer, and employs tactics such as phishing, scam websites impersonating crypto products, and ransomware deployment. The campaign has reportedly resulted in financial losses exceeding $1 million. The attack techniques correspond to MITRE ATT&CK tactics such as T1583 (Acquire Infrastructure), T1176 (Browser Extensions), T1102 (Web Service), T1608 (Stage Capabilities), T1204 (User Execution), T1056 (Input Capture), T1132 (Data Encoding), T1585 (Establish Accounts), T1588 (Obtain Capabilities), and T1189 (Drive-by Compromise). This coordinated campaign represents a sophisticated threat targeting cryptocurrency users through multiple vectors, leveraging social engineering, technical exploitation, and AI-driven scaling.

Detailed information about 650 Attack Tools, One Coordinated Campaign. Get real-time updates, technical details, and mitigation strategies.

650 Attack Tools, One Coordinated Campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

650 Attack Tools, One Coordinated Campaign

A threat actor has orchestrated a sophisticated malvertising campaign impersonating Kling AI, a popular AI-powered image and video synthesis tool. The attackers use counterfeit Facebook pages and paid ads to drive traffic to a convincing fake website. Users are tricked into downloading malicious files disguised as AI-generated media, which are actually executable loaders. These loaders employ advanced evasion techniques, including .NET Native AOT compilation, and deploy infostealers with extensive monitoring capabilities. The campaign has a global reach, particularly targeting users in Asia, and exploits the growing popularity of AI content generation platforms. The malware focuses on stealing credentials, session tokens, and monitoring crypto-related activities across multiple browsers and applications.

The threat described is a sophisticated malvertising campaign leveraging Facebook's advertising platform to impersonate Kling AI, a well-known AI-powered image and video synthesis tool. Attackers create counterfeit Facebook pages and deploy paid advertisements to lure users to a fake website that convincingly mimics the legitimate Kling AI platform. The primary attack vector involves tricking users into downloading malicious executable files disguised as AI-generated media content. These executables are loaders compiled using advanced .NET Native Ahead-Of-Time (AOT) compilation techniques, which help evade detection by traditional antivirus and endpoint security solutions. Once executed, the loaders deploy infostealer malware with extensive capabilities, including credential theft, session token harvesting, and monitoring of cryptocurrency-related activities across multiple browsers and applications. The malware also employs advanced evasion and persistence techniques, such as process injection (T1055), credential dumping (T1005, T1555), and establishing persistence mechanisms (T1547.001). The campaign exploits the rising popularity of AI content generation platforms to increase its reach and effectiveness. While the campaign has a global footprint, it is particularly active in Asia. The malware's focus on stealing sensitive credentials and crypto assets indicates a financially motivated adversary aiming to monetize compromised accounts and wallets. The use of malvertising on Facebook suggests a high level of operational sophistication, leveraging social engineering and trusted platforms to maximize victim engagement. No known exploits in the wild have been reported for this campaign, but the threat remains active and evolving.

Detailed information about The Sting of Fake Kling: Facebook Malvertising Lures Victims to Fake AI Generation Website. Get real-time updates, technical details,

Title	Severity	Type	Source	Date

Threats Tagged 'crypto theft'

Filter Threats

Threats Tagged 'crypto theft'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility