Oct 5, 2026
1 new drain, 2 updates.
New
-
Medium◐Partly contained
16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys
Socket found 16 Firefox extensions posing as Rabby Wallet (branded 'Raabby WaIIet') and OKX Wallet ('Portal WALLET'). They captured 12- or 24-word recovery phrases and private keys during the wallet import step and sent them to attacker-run Cloudflare Workers. Mozilla removed them by 5 October 2026, but Socket links them to a crypto-theft extension campaign it first saw in August 2026, so new copies may appear. No loss figure has been published; anyone who imported a seed into one of them should treat that wallet as stolen.
Firefox users who installed fake Rabby Wallet or OKX Wallet add-ons·Multiple EVM chains·Since Oct 5, 2026·
Updated
-
High✕Still active
User loses about $305K in DAI after copying a poisoned lookalike address from history
On 4 October 2026 GoPlus Security flagged a loss of about $305,000 in DAI. The attacker made an address with the same first and last characters as the victim's usual recipient, sent dust transfers so it appeared in the victim's history, and the victim copied it for a large transfer. GoPlus warned these campaigns are now fully automated, from finding targets to laundering. Reports did not name the chain.
A DAI holder sending to a regular counterparty·Multiple EVM chains·$305K stolen·Since Oct 4, 2026·
-
Critical✕Still active
Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March
A Ransom-ISAC report published on 5 October 2026 says the Inferno drainer ecosystem, now branded AngelFerno after merging with Angel Drainer, was still running in summer 2026 with thousands of affiliates. It says AngelFerno announced it had bought Purple Drainer in March 2026, that its factory has deployed over 17,000 single-use drainer contracts, and that it targets 165 tokens on 11 EVM chains (with Solana, TRON, SUI and XRP variants). The report ties it to domain takeovers including CoW Protocol in April 2026 (about $1.2M lost) and notes a May 2026 key rotation that locked the operators out of their own command contract for about 23 days.
Web3 users targeted by Inferno/AngelFerno affiliate phishing sites and domain takeovers·Multiple EVM chains·Since Mar 1, 2026·