GreedyBear: 150 Firefox extensions stole over $1 million worth of cryptocurrency

[lovesmayfamilis]

The forum often suggests using the Firefox browser as the most secure browser, as opposed to the Google-based browser. However, recent news suggests that it is not safe either, especially for users who like to clutter their browsers with various add-ons.
The news itself states that approximately 150 extensions were discovered, which had stolen around a million dollars from users over a specified period.
"The scam add-ons disguised themselves as popular crypto wallet extensions from well-known platforms, including MetaMask, TronLink, Exodus, and Rabby Wallet. They were initially uploaded to the store without malicious code to pass the checks and were left dormant for some time to accumulate fake positive reviews.
At a later stage of the attack, the extension publishers removed the original branding and replaced it with new names and logos, as well as embedded malware into the code designed to steal wallet data and user IP addresses (likely for tracking or targeting).
The malware acted as a keylogger, intercepting input from form fields and pop-ups, and then sending it to the attackers' server."
In addition to Firefox extensions, this operation involves dozens of Russian-language pirated software sites that facilitate the distribution of 500 different malware-laden executable files, as well as a network of sites posing as official Trezor and Jupiter Wallet resources and fake hardware wallet repair services."

https://blog.koi.security/greedy-bear-massive-crypto-wallet-attack-spans-across-multiple-vectors-3e8628831a05
https://xakep.ru/2025/08/08/greedybear/

As a result, you can certainly conclude for yourself that the use of add-ons, which at first glance may seem legitimate and harmless, over time can acquire a dangerous direction, which means we must be very careful and reduce the use of add-ons to a minimum. Today's use of AI is becoming a gold mine for scammers, since these technologies are not only used in a positive direction.

[Outhue]

Firefox browser is the type that fresh pc users like to go for, because they have no clue how bad the browser has become, I always advice against the use of firefox browser and till date the team never asked themselves why they are losing users, it seems that they don't care.

This type of attack is similar to that of apps on Google play store, where people just visit and search for any app they want, and eventually they download the wrong thing, people still go on add-on store on mozilla Firefox and that of Chromewebstore to download add on, this is how the become victim.

It's all about the laziness and misuse of the Internet, people need to know that only the official platform can direct you to the original app or software you seek, anything third party in the space is wrong.

[Hatchy]

The fact now is they are always targeting crypto users because they know quite well how vulnerable crypto users are. Till date most people still stores their keys on their devices even with the countless number of warnings and stories online.

One thing I tell people is, if you have no reason to install an add-on, then don't bother using it. Yes it makes your browser a little bit more interesting, but safety should come first.

It's all about the laziness and misuse of the Internet, people need to know that only the official platform can direct you to the original app or software you seek, anything third party in the space is wrong.

Not everyone would be aware of this. Many are lazy to do a little research. They want quick results which leads to their early losses..

[Upgrade00]

Users are usually advised to be careful of extensions they allow and user scripts they use, it is easily for a dev to slip a malicious code in or start out legitimately but then switch up at a later time. Firefox also adds warnings on some add-ons to show that they do not actively monitor them as a prompt to do your own research.

Malicious extensions can catch you out on any browser if you're not careful and google based browsers has the extra privacy and security risk.

[ABCbits]

The forum often suggests using the Firefox browser as the most secure browser, as opposed to the Google-based browser.

Is it that common? I usually see people recommend Firefox due to better privacy (compared with Google Chrome).

"The scam add-ons disguised themselves as popular crypto wallet extensions from well-known platforms, including MetaMask, TronLink, Exodus, and Rabby Wallet. They were initially uploaded to the store without malicious code to pass the checks and were left dormant for some time to accumulate fake positive reviews.
At a later stage of the attack, the extension publishers removed the original branding and replaced it with new names and logos, as well as embedded malware into the code designed to steal wallet data and user IP addresses (likely for tracking or targeting).
The malware acted as a keylogger, intercepting input from form fields and pop-ups, and then sending it to the attackers' server."

This is really nasty method. I think almost all place to download browser add-ons wouldn't perform very detailed review/check for updated add-ons, especially one with some reputation.

[SmartGold01]

Currently I am using Firefox to access this forum through mobile version of it, although I found it boring using the web version of it because of ads displayed on it just like opera mini and Phoenix btowser or some other browsers that mostly carries out this ads of a thing. We can assure privacy from any of those browser because when scammers targets a particular browser they must definitely execute it without undermining how secure and private they seems to be. Again, it's very important to stop using some of these extensions as they are the major target that leads to some of the hacks or scams people are experiencing today, to stay safe it would be better to stop using such extension on some these our browsers.

[btcnbegun]

People consider Firefox as one of the best browser. Cyber crime is at its peak though. Some crypto extensions are never scanned for malwares before making them available for internet. Recently, chrome acted upon some crypto extensions and removed such malwares. FF is learning.

[boyptc]

I think as long as we're not using most of these extensions if we use firefox, we should just be fine. And before we download any of them, we verify to check the authenticity if it's an official.

I use firefox and in fact, typing this is with firefox. I'm not that type of guy that uses extensions or add-ons.

The convenience that these extensions bring is there but, if it's about privacy and security then it's best to just download the actual wallet app and use it so to no intention of sucking vital data from the browsers that we use.

[Mia Chloe]

The forum often suggests using the Firefox browser as the most secure browser, as opposed to the Google-based browser. However, recent news suggests that it is not safe either, especially for users who like to clutter their browsers with various add-ons.

Me rushing over to my browser on my PC to uninstall all extensions (kidding though). Anyways the phrase verify not trust is exactly having a play out in this particular case. The bottom line is if an extension is not extremely important don't bother installing it.

Plus if you don't know how to verify if am extension is open source and authentic, there's no need to make use of them. Many of these crypto guys you see losing a ton to these kind of hacks usually have zero technical knowledge.

[Patikno]

Some time ago, I often used the Firefox browser for various purposes, such as conducting testnets or airdrops, bridging my crypto assets on certain sites, or anything else which were also related to my crypto activities, and also about installing add-ons (extensions) for several crypto wallets. However, I no longer use it. I think I am better off using the Chrome browser now, because I think it is easier and safer to use, especially since there was a lot of news about a similar issue some time ago, so I switched to it. Additionally, I find official add-ons provided by developers more often in Chrome than in Firefox, so this is also my main reason for using it.

However, I think everyone has the right to decide which browser they will choose, but stay alert, and my advice is to always choose from official sources in whatever you do, especially when installing add-ons or extensions.

[BIT-BENDER]

People consider Firefox as one of the best browser. Cyber crime is at its peak though. Some crypto extensions are never scanned for malwares before making them available for internet. Recently, chrome acted upon some crypto extensions and removed such malwares. FF is learning.

I don't know who is considering fire fox as the best browser, in what aspects is fire fox the best browser. For me I am interested in a browser that is secure, and support anonymity, and Tor browser is ahead of fire fox in that regards. But know that you also contribute in getting attacked by malware. You can't just keep visiting any random site and expect not to encounter malware.

[coupable]

This type of attack is similar to that of apps on Google play store, where people just visit and search for any app they want, and eventually they download the wrong thing, people still go on add-on store on mozilla Firefox and that of Chromewebstore to download add on, this is how the become victim.

It's all about the laziness and misuse of the Internet, people need to know that only the official platform can direct you to the original app or software you seek, anything third party in the space is wrong.

People can't be totally blamed because they trust a big brand like chrome or mozilla. Not everybody is technically expert to look and check for other alternatives when we have some few big companies known for their outstanding originality in this field. Me personally, i had the idea that play store android is protected by strict measures that forbid hackers from adding malwares until i discovered that apps can be updated later with viruses and malicious addons and that i have to check online reviews before installing any app even if it's well rated. Here come the opportunity to mozilla devs to find how they can protect their custmers base because it can't be relied only on the users capabilities because most of them if fallen victim he will just rate the app as risky and leave it forever.

[348Judah]

The forum often suggests using the Firefox browser as the most secure browser, as opposed to the Google-based browser. However, recent news suggests that it is not safe either, especially for users who like to clutter their browsers with various add-ons.
The news itself states that approximately 150 extensions were discovered, which had stolen around a million dollars from users over a specified period.

Nothing is safe in life 100% the better we begin to sleep with one eye opened, because scammers can use any route to attack us, even the so called secured ways, we should always review and check for updates, at least, to an extent, i appreciate the exposure made form this thread, because some would have made up their mind already that there's not going to be anything of such from the specific browser they use to serve as threat to their security.

[CryptSafe]

Long ago, I discontinued the use of the Firefox browser as I wasn't just comfortable using it, and I do not like their UI because it doesn't entice me to constantly use it, so I just stopped using it. Maybe it was a way of keeping me safe from events as such, who knows, and here we are hearing this story. Although I had lots of extensions attached to the Firefox browser, which I do use, but after some time, I was not just comfortable using the browser anymore, so I had to switch to Chrome. Who knows if that was how  God was trying to avert some funny events from happening?

As for the extensions, not everybody is technically inclined to have that knowledge on how to properly examine extensions, some would just go ahead to download and install them because they got it from the website direct and that alone would give them the confidence that they downloaded it from the website direct so they would not have any fear and considering the fact that it is a brand with a reputable name in the industry, thy will have nothing to worry about.

Henceforth, I will properly do my own research, and an examination would have to be done on extensions before I move further to download any extension, because from the looks, extension hack would definitely be more disastrous than others we have been hearing, because I believe the majority of the crypto community have extensions installed on their browser so that would be an easy get for hackers. We just have to be careful and alert while downloading extensions from various sources, and also, for those who run extension nodes and extension aidrops, you just have to be more and extremely careful this time around.

[Odohu]

I don't know if we should blame Firefox for these breaches or if we should blame people but what I do know is that Firefox is one of the worst browsers out there and they have little interest in fighting criminals. No wonder my company and many other organisations I know banned the installation of Firefox in their official computers. Apart from being careful with extensions, I will encourage people to use other browsers that have no such infamous history.

[Nwada001]

People consider Firefox as one of the best browser. Cyber crime is at its peak though. Some crypto extensions are never scanned for malwares before making them available for internet. Recently, chrome acted upon some crypto extensions and removed such malwares. FF is learning.

No matter how secure something appears to be, it's also in the users' best interest to make sure that they are careful while using it, especially when the time to use it for anything that has to do with funds comes. An extension is not just supposed to be installed when we don't trust the developer, especially on a PC we make use of and could easily be used to access our crypto wallet.

[Ndabagi01]

Me rushing over to my browser on my PC to uninstall all extensions (kidding though). Anyways the phrase verify not trust is exactly having a play out in this particular case. The bottom line is if an extension is not extremely important don't bother installing it.

Plus if you don't know how to verify if am extension is open source and authentic, there's no need to make use of them. Many of these crypto guys you see losing a ton to these kind of hacks usually have zero technical knowledge.

Being technically inclined in this crypto space is also important for all. You don’t need to know that deep but knowing how to secure your personal data that is prone to hack and holds vital information should be one of your priorities in this crypto space.

Anything you’re engaging with online, always look at the disadvantageous aspect of it and how you can curb not falling into the scammers den using such tools. I am not a fan of too many extensions in my browser, I have few of them and I don’t allow them to have any relation to allow them hack into my personal data.

[Smartvirus]

The forum often suggests using the Firefox browser as the most secure browser, as opposed to the Google-based browser.

Is it that common? I usually see people recommend Firefox due to better privacy (compared with Google Chrome).

It’s not common obviously and the problem as I see it here isn’t about the browser itself but, the extensions in which, the users themselves get to attach with the browser. We can’t really fault the browser on that note given that, we did put these extension setups in place and most times, not without any proper research on where it came from, we set it up because it works and that’s it.

Well, this is an eye opener eventually on the possibilities of hacks from these extensions.

[lovesmayfamilis]

The forum often suggests using the Firefox browser as the most secure browser, as opposed to the Google-based browser. However, recent news suggests that it is not safe either, especially for users who like to clutter their browsers with various add-ons.

Me rushing over to my browser on my PC to uninstall all extensions (kidding though). Anyways the phrase verify not trust is exactly having a play out in this particular case. The bottom line is if an extension is not extremely important don't bother installing it.

Plus if you don't know how to verify if am extension is open source and authentic, there's no need to make use of them. Many of these crypto guys you see losing a ton to these kind of hacks usually have zero technical knowledge.

That's right, verification is always mandatory. However, many extensions from this history have gained a lot of reviews, and people often use reading these reviews as an additional factor for trust. For me, they have now lost their meaning since they are no longer necessary. I would say that you need to trust what has been tested for a long time (old and necessary additions), and perhaps does not require updates, and the updates themselves can be easily disabled or not updated automatically. In addition, the browser itself can be configured through the about:config , having read and understood which functions you need and which are not at all necessary.

[libert19]

...However, many extensions from this history have gained a lot of reviews, and people often use reading these reviews as an additional factor for trust.

I am one of those who reads reviews to verify legitimacy of app, even if reviews are 'positive' but the way are worded often give away whether they are genuine or not, but with the rise of AI not sure how long this will work.