The "GreedyBear" cybercrime group stole over $1 million in crypto using a technique called "extension hollowing." The group uses AI-generated phishing content and malicious browser extensions to harvest wallet credentials.