Physical layer security aspects of wireless networks have recently attracted an increased attention due to the emergence of large-scale decentralized networks. While most existing literature focuses on link-level performance analysis from the perspective of the wireless users, this paper turns the attention to the eavesdroppers’ (attacker) side of the problem. In this context, we introduce a model that enables a number of single antenna eavesdroppers in a wireless network to cooperate, by performing distributed receive beamforming, for improving the damage that they inflict on the network’s wireless users when tapping through their transmissions. We model the eavesdroppers cooperation problem as a non-transferable coalitional game and we propose a distributed algorithm for coalition formation. The proposed algorithm allows the eavesdroppers to take autonomous decisions to cooperate and form coalitions, while maximizing the damage that they cause on the wireless users. This damage is quantified in terms of the overall secrecy capacity reduction that the eavesdroppers incur on the users while taking into account cooperation costs in terms of the time required for information exchange. We analyze the resulting coalitional structures, discuss their properties, and study how the eavesdroppers can adapt the topology to environmental changes such as mobility. Simulation results show that the proposed algorithm allows the eavesdroppers to cooperate and self-organize while achieving an improvement of the average payoff per eavesdropper up to 27.6% per eavesdropping cycle relative to the non-cooperative case.