GreedyBear Scam Group Elevates Cryptocurrency Theft to an Industrial Scale

According to a report by Jinse Finance, cybersecurity firm Koi Security has revealed that a malicious operation has stolen over $1 million in cryptocurrency by leveraging hundreds of browser extensions, websites, and malware, combining three different attack methods. Tuval Admoni, a researcher at Koi Security, stated on Thursday that the company has named this malicious group "GreedyBear," noting that they have "redefined cryptocurrency theft on an industrial scale." "Most groups tend to focus on a single method—such as targeting browser extensions, specializing in ransomware, or running phishing websites—but GreedyBear asked, 'Why not use all three?' And they actually succeeded, which is truly astonishing," Admoni said. The report points out that while the types of attacks used by GreedyBear have been seen before, cybercriminals are now deploying more sophisticated, multi-layered scams to target crypto users. Admoni added that this shows these scam groups are no longer "just thinking small."