A new, large-scale cyber campaign called "GreedyBear," has already captured more than a million dollars in crypto currency worldwide. The attack targets users of popular wallets such as MetaMask, TronLink, Exodus and Rabby Wallet, through more than 150 malicious browser extensions in the Firefox Marketplace.
Researchers at Koi Security discovered that the criminals use a technique they call "Extension Hollowing. This involves first placing innocent extensions to pass checks, complete with fake positive reviews, then later covertly adding malicious code. The extensions steal wallet data and IP addresses, and send them to servers under the control of the attackers.
The campaign appears to be a continuation of previous "Foxy Wallet" attacks and is now spreading to other browsers, including Chrome. It also sets up fake sites posing as wallet repair tools, and spreads information thieves and even ransomware via Russian sites with pirated software.
Moreover, it has become clear that the criminals are using AI tools to develop attacks on a large scale and at great speed. A second major fraud, discovered by SentinelOne, uses AI-generated YouTube videos and old, "legitimate"-looking accounts to promote fake crypto-trading bots. Once victims follow the instructions and send ETH to a smart contract, the funds disappear into criminal wallets.
Suriname cybersecurity company Avigdor warns that local users are also vulnerable, as more and more Surinamese are trading cryptocurrencies. According to the company, it is crucial to download browser extensions and apps only from official, trusted sources and to always verify publishers. Wallet transactions for larger amounts should preferably take place offline via hardware wallets or cold storage, so that browser attacks do not have direct access.
In addition, users should remain alert to overly fancy promises, such as trading bots claiming guaranteed profits, and be aware that cybercriminals are operating with increasing credibility using AI. Security extensions and up-to-date software can help block phishing and malware sites. Reporting suspicious websites or videos to the relevant platforms speeds their removal.
Avigdor calls on companies, financial institutions and governments in Suriname to invest in security-awareness programs so that personnel recognize threats faster, from classic phishing to AI-driven scams. It is not a question of if, but when these methods will emerge in Suriname the company warns. Preparation and awareness are our first line of defense.
