GreedyBear’s AI-Driven Attacks Signal New Era in Crypto Cybercrime

Russia-linked cybercrime group GreedyBear has stolen over $1 million in cryptocurrency through sophisticated AI-driven tactics, marking a significant escalation in digital asset theft. The operation leverages 150 malicious Firefox extensions masquerading as legitimate crypto wallets, with high-traffic platforms like MetaMask being primary targets.

The group employs a deceptive technique of initially releasing legitimate wallet extensions to build trust before updating them with malicious code. This code hijacks transactions when victims attempt to sign in. Cybersecurity researchers note the attackers also publish common tools to gather positive reviews before converting them into attack vectors.

Two Seas Capital has simultaneously opposed Core Scientific's $9 billion buyout, citing undervaluation—a MOVE that could shift sector valuations. The developments underscore growing security risks and market volatility in the cryptocurrency space.