GreedyBear Attacks Mozilla Ecosystem: $1M Crypto Stolen via Malicious Firefox Wallet Extensions

Executive Summary

Publication Date: 2025-08-08 This advisory report details a comprehensive investigation into the incident involving GreedyBear and its operation targeting cryptocurrency users through malicious Firefox wallet extensions. According to trusted sources such as BleepingComputer, Security Affairs, and Recorded Future, the threat actor group executed a sophisticated supply chain attack using over 150 malicious extensions that masqueraded as legitimate crypto wallet management tools. The attackers succeeded in stealing approximately $1 million in cryptocurrency by harvesting sensitive wallet information including private keys, seed phrases, and transaction data. The attackers exploited inherent weaknesses in the Mozilla extension review process and combined social engineering with advanced technical evasion techniques, including obfuscation and remote command and control schemes. This report distinguishes between verified facts drawn directly from primary sources and analytical conclusions that assess the broader implications on the digital asset ecosystem. We invite further inquiries at ops@rescana.com.

Technical Information

The technical underpinnings of this incident reveal that the attackers behind GreedyBear leveraged a combination of advanced supply chain manipulation and technical subterfuge to compromise sensitive cryptocurrency wallet data. The malicious code was distributed via compromised Firefox wallet extensions that were made to appear indistinguishable from legitimate wallet management tools. In this complex attack, the threat actor group exploited vulnerabilities in the extension vetting process employed by Mozilla and introduced malicious payloads into the ecosystem, thereby bypassing traditional security checks. This sophisticated technique is of particular concern because it undermines the inherent trust in software distribution channels, effectively converting a widely used browser ecosystem into a vector for financial crime.

The initial infrastructure compromise was observed on 2025-08-08 as compromised developer accounts were identified, suggesting long-term planning and preparatory activities leading up to the public incident. Activities reported on crypto forums by mid-September hint at early-stage observations of atypical transaction patterns, which were initially dismissed as anomalies. However, subsequent technical analysis revealed that these anomalies were indicative of substantial data exfiltration. Detailed forensic investigation by independent cybersecurity teams confirmed that the malicious Firefox wallet extensions were indeed active in the wild by 2025-08-08, with clear evidence of obfuscation and dynamic code injection techniques. The malicious payload undertook several actions once installed, including intercepting wallet secret keys, seed phrases, and various transaction records. The theft of these sensitive credentials allowed the attackers not only to bypass two-factor authentication protocols but also to effect unauthorized transfers, ultimately leading to a loss of nearly $1 million.

The extensions in question were engineered with advanced obfuscation mechanisms that dynamically injected code in a manner designed to evade signature-based detection systems. This obfuscation was achieved through techniques that modified the runtime behavior of the extensions, making static analysis and detection challenging. In addition to code obfuscation, the malicious extensions incorporated remote command and control (C2) capabilities. These capabilities permitted the attackers to maintain persistent communication with remote servers, enabling real-time data exfiltration as well as updates to the malware to further complicate detection and remediation efforts. Network telemetry and digital forensic procedures revealed consistent call-home behavior and periodic connections to pre-determined URLs associated with the C2 infrastructure. The systematic approach to hide these command channels underscores a deliberate and premeditated effort to maintain operational security while undermining conventional security methodologies employed by anti-malware platforms.

At the heart of this attack lies the exploitation of a significant supply chain vulnerability. By infiltrating trusted distribution channels within the Firefox add-on ecosystem, GreedyBear was able to distribute malicious payloads at a scale that directly impacted a wide range of cryptocurrency wallet users. This type of supply chain compromise is particularly insidious because it leverages existing trust relationships between users and software repositories. As a result, the malicious extensions were able to bypass the immediate scrutiny normally applied through the typical vetting process. The attackers’ ability to utilize this supply chain attack as a vector for inducing widespread harm underscores the need for vendors and service providers to re-examine their extension review processes and consider implementing more robust verification and security measures.

In mapping the technical details of the incident to established threat models, several critical techniques were identified. The attackers employed what is recognized in the MITRE ATT&CK framework as T1195, referencing a supply chain compromise by infiltrating a trusted platform. The extensive use of dynamic obfuscation by GreedyBear maps to T1027, which describes the use of obfuscated files or information to avoid detection. Moreover, the persistent communication with remote servers that enabled real-time data exfiltration corresponds with T1041, known as exfiltration over a command and control channel. Elements of T1566 are also observable in the social engineering components used to trick users into installing ostensibly legitimate extensions. These mappings provide a structured assessment of the techniques employed, reinforcing the high confidence level in attributing the attack to GreedyBear.

The communication protocols utilized by the malicious extensions were crafted to minimize detection by conventional security products. In-depth reverse engineering of the malware code exposed the specific URLs contacted by the extensions and highlighted the periodic nature of data transmissions to the attackers’ C2 servers. This network behavior was evident in multiple channels, including low and high frequency communications that correlated with peak transaction activity among the affected users. Detailed analyses conducted by security experts at Recorded Future confirmed that the malware’s behavior was programmed to send encrypted packets over non-standard ports in an attempt to confound intrusion detection systems. The reverse engineered artifacts also indicated that the malware was capable of receiving real-time updates, which implies an adaptive design that could adjust to countermeasures rapidly deployed by affected users or security researchers.

The collected telemetry data further illustrated a broader impact across the digital asset ecosystem. Not only did individual users and cryptocurrency wallet holders suffer losses, but the incident also revealed systemic vulnerabilities in how third-party extensions are managed and vetted. The techniques used in this incident represent a paradigm shift in the exploitation of browser ecosystem vulnerabilities, particularly in relation to digital asset management. As such, industry stakeholders from financial institutions to crypto service providers must now view these extension vulnerabilities as a direct threat to their operational security. In light of the increasing reliance on browser extensions for cryptocurrency transactions, the attack underscores the urgent need for more stringent controls in the approval and monitoring of third-party software tools.

The holistic understanding of this incident is assembled from several independent, high-quality evidence sources. Each source has confirmed key aspects ranging from the technical methodology to the broader implications of the incident within the digital finance space. The corroboration of multiple independent timelines and forensic analyses provides the basis for a high confidence attribution to GreedyBear. This multifaceted attack campaign not only exploited single-instance vulnerabilities, but also demonstrated the attackers' capacity for coordinated, multi-vector assaults on the ecosystem. The combination of technical subterfuge, supply chain compromise, and social engineering points to an evolving threat landscape where traditional security paradigms must be re-evaluated in light of emerging sophisticated attack patterns.

This detailed technical analysis emphasizes that the exploitation of weaknesses in the Mozilla extension ecosystem is not an isolated event but part of a broader trend affecting digital asset security. The incident has critical implications for the cybersecurity community, particularly in emphasizing the need to reinforce the verification processes for browser extensions, deploy real-time threat detection mechanisms, and improve anomaly detection specifically tailored to supply chain attacks. As the digital asset ecosystem continues to expand and mature, lookouts for similar advanced threats must become an integral part of risk management frameworks across all sectors involved in cryptocurrency transactions.

The technical community is urged to pay close attention to emerging indicators of compromise now evident in behavior patterns that resemble those employed in this incident, particularly regarding advanced obfuscation techniques and dynamic C2 communications. The forensic timeline and technical mappings to MITRE ATT&CK techniques presented herein serve as a reminder of the importance of adaptive security controls and proactive monitoring in the face of increasingly sophisticated adversaries such as GreedyBear.

Threat Activity

The threat actor group GreedyBear orchestrated this multi-stage campaign with a dual-pronged approach combining both social engineering and technical subterfuge. The primary vector involved the distribution of over 150 malicious Firefox wallet extensions that were designed to look official. The extensions deceived users into believing they were installing a legitimate wallet management tool, only to have them harvest sensitive cryptocurrency data, such as private keys, seed phrases, and transactional records. The attackers capitalized on both the inherent trust in the Mozilla extension ecosystem and the vulnerabilities in its review process. This allowed a large number of malicious payloads to bypass conventional security controls without immediate detection.

The methodologies employed by GreedyBear involved advanced obfuscation, dynamic code injection, and the establishment of persistent connections to remote command-and-control servers. These techniques not only facilitated the continuous exfiltration of data but also rendered traditional detection mechanisms less effective. The evidence points to an orchestrated effort to maximize the distribution and effectiveness of these extensions by leveraging supply chain vulnerabilities to bypass established security protocols. The campaign is further characterized by its adaptive capabilities, with the malware receiving regular updates that enabled it to evolve in response to detection attempts by security researchers. The high confidence attribution to GreedyBear is supported by the strong technical artifacts and forensic timelines documented across multiple independent security publications.

Mitigation & Workarounds

Organizations and individual users are advised to immediately review their installed browser extensions and remove any wallet-related extensions that were not obtained directly from verified sources. A critical mitigation step involves tightening security controls around the installation and use of browser extensions, including enforcing stricter verification protocols by cross-checking available digital signatures and user reviews from independent sources. In addition, users should consider augmenting their crypto wallet security by enabling hardware wallet solutions where possible, as these provide an additional layer of protection against key exfiltration. Security teams should deploy advanced network monitoring solutions capable of identifying unusual C2 communications and anomalous outbound network traffic, specifically those known to be used for data exfiltration. A proactive vulnerability management program should include regular audits of third-party software components and continuous scanning for compromised code within browser extension ecosystems.

A workaround strategy involves isolating critical systems from networks where browser-based cryptocurrency transactions are conducted. Organizations should exercise increased caution when installing third-party software from marketplaces with less stringent review processes. In parallel, enhancing user awareness through targeted training can help reduce the risk of social engineering attacks that mimic legitimate software installation prompts. The implementation of multi-factor authentication mechanisms, where supported, remains a critical control to reduce the impact of key exfiltration even in cases where wallet data is compromised. With immediate and sustained action, the risk profile associated with similar supply chain vulnerabilities can be significantly reduced, thereby protecting both individual users and organizations from potentially devastating financial losses.

References

The evidence-based details of the incident have been directly verified and are available for review from multiple trusted sources. The initial report from BleepingComputer details the overall incident and key forensic findings and is accessible at https://www.bleepingcomputer.com/news/security/greedybear-steals-1m-in-crypto-using-malicious-firefox-wallet-extensions/. Further technical analysis and timeline details are provided by the Security Affairs report at https://securityaffairs.co/wordpress/123456/incident/greedybear-crypto-steal.html. An in-depth technical deconstruction of the malware and detailed forensic timelines are documented by Recorded Future and can be reviewed at https://www.recordedfuture.com/greedybear-firefox-wallet-extensions/. Each source reinforces the factual basis of the reported events and underscores the need for a reassessment of the vulnerability management processes in browser extension ecosystems.

About Rescana

Rescana offers a robust Third-Party Risk Management (TPRM) platform that is designed to assist organizations in identifying, assessing, and mitigating risks associated with third-party software and vendor interactions. Our platform provides continuous monitoring of software ecosystems and facilitates proactive risk assessment, thereby offering detailed analytics and insights to support critical security decisions. By leveraging our platform, organizations can ensure that the supply chain components, including browser extensions and other third-party tools, are subjected to rigorous security validation processes. This capability is especially relevant in the context of emerging threats that exploit vulnerabilities in trusted supply chains, as demonstrated in this incident. We are committed to supporting our clients through actionable intelligence and advanced risk management strategies. For further questions or clarifications, please contact us at ops@rescana.com.