{
 "slug": "bookmarklet-drains-solana-trading-terminals-wave",
 "title": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
 "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave",
 "json": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave.json",
 "status": "live",
 "severity": "high",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "solana"
 ],
 "method": "bookmarklet",
 "product": "Users of web-based Solana memecoin trading apps (reported: Axiom, Fomo)",
 "tags": [
  "solana",
  "bookmarklet",
  "campaign",
  "axiom",
  "fomo",
  "trading-terminal",
  "embedded-wallet",
  "session-hijack",
  "fake-verification",
  "drainer-tooling"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2025-12-26",
 "closedAt": null,
 "updatedAt": "2026-10-08T12:00:00Z",
 "summary": "Since at least late 2025, scammers have used fake tools and fake 'verification' steps to get Solana memecoin traders to drag a bookmark into their browser and click it on a trading site they are logged in to, where it takes the session or wallet data and the account is drained. Reports cover Axiom traders in December 2025 and a Fomo user who lost about $48,000 in October 2026; SlowMist called it an old method being reused. In September 2026 Socket found theft code in malicious extensions labelled as Axiom bookmarklet tooling and noted that Axiom bookmark drainers circulate publicly. Traders on any web terminal should refuse any bookmark from others, use MFA and keep trading wallets small.",
 "timeline": [
  {
   "date": "2025-12-26",
   "title": "X users warned of the 'Axiom Bookmark Method', with a trending summary claiming over $200,000 drained.",
   "sourceUrl": "https://x.com/insidecalls/status/2004593677138550834"
  },
  {
   "date": "2026-09-09",
   "title": "Socket reported malicious Chrome and Firefox extensions stealing trading-terminal session and wallet data, with code labelled as Axiom bookmarklet tooling.",
   "sourceUrl": "https://socket.dev/blog/chrome-firefox-crypto-data-theft"
  },
  {
   "date": "2026-10-08",
   "title": "SlowMist warned of bookmark phishing against Fomo users, calling it an old exploitation method, and published an analysis of a $48,000 loss.",
   "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "Threat Intelligence | Analysis of a Malicious Bookmark Phishing Attack Targeting Fomo Users",
   "url": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36",
   "publisher": "SlowMist",
   "date": "2026-10-08"
  },
  {
   "kind": "advisory",
   "title": "SlowMist TI Alert: bookmark-based phishing attacks targeting the Fomo web interface",
   "url": "https://x.com/SlowMist_Team/status/2108039792219013578",
   "publisher": "SlowMist (X)",
   "date": "2026-10-08"
  },
  {
   "kind": "writeup",
   "title": "Malicious Chrome and Firefox Extensions Steal Crypto Traders' Session and Wallet Data",
   "url": "https://socket.dev/blog/chrome-firefox-crypto-data-theft",
   "publisher": "Socket",
   "date": "2026-09-09"
  },
  {
   "kind": "social",
   "title": "Inside Calls on X: The 'Axiom Bookmark Method' warning",
   "url": "https://x.com/insidecalls/status/2004593677138550834",
   "publisher": "X (@insidecalls)",
   "date": "2025-12-26"
  }
 ],
 "indicators": {
  "domains": [
   "voltage[.]family"
  ],
  "addresses": [
   "D783JqupQ2FYhkxUfGEd1gaFEoAJDXRX1NEb4aVH2hZ6"
  ]
 },
 "brief": "## Am I affected?\nYou may be affected if you ever added a bookmark that someone else gave you (by dragging a button, icon or link to your bookmarks bar) and clicked it while logged in to a trading site or wallet. Look through your bookmarks bar for entries you did not make, especially ones with names like 'verify', 'checker' or 'click to verify'.\n\n## What to do now\n- Delete the bookmark.\n- Move funds from the affected trading wallet to a fresh wallet.\n- From a trusted device, log out of all sessions on the site, revoke sessions and turn on MFA.\n- Check the email or Google account you log in with.\n\n## How to avoid this\n- Never drag or click a bookmark someone sends you, whether from a Telegram or Discord bot, a 'support' account, an 'alpha' group or a website.\n- Real verification, CAPTCHAs and support never ask for this.\n- Treat links on token pages and in group chats as untrusted.\n- Keep trading wallets small and move profits out often.",
 "notes": null,
 "agentBrief": "# Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps\n\n- Severity: High · Status: Still active (live)\n- Chains: Solana · Method: Bookmarklet drains\n- Started: Dec 26, 2025 · Last update: Oct 8, 2026\n- Who/what: Users of web-based Solana memecoin trading apps (reported: Axiom, Fomo)\n\nSince at least late 2025, scammers have used fake tools and fake 'verification' steps to get Solana memecoin traders to drag a bookmark into their browser and click it on a trading site they are logged in to, where it takes the session or wallet data and the account is drained. Reports cover Axiom traders in December 2025 and a Fomo user who lost about $48,000 in October 2026; SlowMist called it an old method being reused. In September 2026 Socket found theft code in malicious extensions labelled as Axiom bookmarklet tooling and noted that Axiom bookmark drainers circulate publicly. Traders on any web terminal should refuse any bookmark from others, use MFA and keep trading wallets small.\n\n## Am I affected?\nYou may be affected if you ever added a bookmark that someone else gave you (by dragging a button, icon or link to your bookmarks bar) and clicked it while logged in to a trading site or wallet. Look through your bookmarks bar for entries you did not make, especially ones with names like 'verify', 'checker' or 'click to verify'.\n\n## What to do now\n- Delete the bookmark.\n- Move funds from the affected trading wallet to a fresh wallet.\n- From a trusted device, log out of all sessions on the site, revoke sessions and turn on MFA.\n- Check the email or Google account you log in with.\n\n## How to avoid this\n- Never drag or click a bookmark someone sends you, whether from a Telegram or Discord bot, a 'support' account, an 'alpha' group or a website.\n- Real verification, CAPTCHAs and support never ask for this.\n- Treat links on token pages and in group chats as untrusted.\n- Keep trading wallets small and move profits out often.\n\n## Indicators (block these, never visit them)\n- Domain: voltage[.]family\n- Address: D783JqupQ2FYhkxUfGEd1gaFEoAJDXRX1NEb4aVH2hZ6\n\n## Sources\n- Threat Intelligence | Analysis of a Malicious Bookmark Phishing Attack Targeting Fomo Users (SlowMist, 2026-10-08): https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36\n- SlowMist TI Alert: bookmark-based phishing attacks targeting the Fomo web interface (SlowMist (X), 2026-10-08): https://x.com/SlowMist_Team/status/2108039792219013578\n- Malicious Chrome and Firefox Extensions Steal Crypto Traders' Session and Wallet Data (Socket, 2026-09-09): https://socket.dev/blog/chrome-firefox-crypto-data-theft\n- Inside Calls on X: The 'Axiom Bookmark Method' warning (X (@insidecalls), 2025-12-26): https://x.com/insidecalls/status/2004593677138550834\n\nFull record: https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave · JSON: https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}