A campaign dubbed "GreedyBear" leveraged over 150 malicious browser extensions to steal more than $1 million in digital assets. The attackers used AI-generated content to build legitimacy for their fake wallets and "extension hollowing" techniques to bypass security reviews on platforms like Firefox.