{
 "slug": "fomo-bookmarklet-fake-verification-oct-2026",
 "title": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
 "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026",
 "json": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026.json",
 "status": "live",
 "severity": "medium",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "solana"
 ],
 "method": "bookmarklet",
 "product": "Fomo web app users (Privy embedded wallets)",
 "tags": [
  "solana",
  "bookmarklet",
  "fomo",
  "privy",
  "embedded-wallet",
  "session-hijack",
  "fake-captcha",
  "fake-verification",
  "token-page-link",
  "slowmist",
  "privacy-cash"
 ],
 "amountUsd": 48000,
 "victims": 1,
 "startedAt": "2026-10-08",
 "closedAt": null,
 "updatedAt": "2026-10-08T12:00:00Z",
 "summary": "A Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds.",
 "timeline": [
  {
   "date": "2026-10-08",
   "title": "SlowMist founder Cos warned on X of bookmark phishing aimed at the Fomo web app, using a fake CAPTCHA and a bookmark clicked two to three times.",
   "sourceUrl": "https://x.com/evilcos/status/2108000520493490578"
  },
  {
   "date": "2026-10-08",
   "title": "SlowMist posted a threat-intel alert saying the technique is an old one now being used against Fomo users.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/2108039792219013578"
  },
  {
   "date": "2026-10-08",
   "title": "SlowMist published its analysis: about $48,000 lost after a link on the MOONLET token page led to a fake verification page; 45,106.85 USDC went to one attacker address in three transfers.",
   "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36"
  },
  {
   "date": "2026-10-08",
   "title": "SlowMist said MistTrack traced the funds through USDC/SOL swaps, address splitting, cross-chain transfers, Privacy Cash and gambling platforms.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/2108169316025893169"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "Threat Intelligence | Analysis of a Malicious Bookmark Phishing Attack Targeting Fomo Users",
   "url": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36",
   "publisher": "SlowMist",
   "date": "2026-10-08"
  },
  {
   "kind": "advisory",
   "title": "SlowMist TI Alert: bookmark-based phishing attacks targeting the Fomo web interface",
   "url": "https://x.com/SlowMist_Team/status/2108039792219013578",
   "publisher": "SlowMist (X)",
   "date": "2026-10-08"
  },
  {
   "kind": "advisory",
   "title": "SlowMist analysis thread on the Fomo bookmark phishing attack",
   "url": "https://x.com/SlowMist_Team/status/2108169316025893169",
   "publisher": "SlowMist (X)",
   "date": "2026-10-08"
  },
  {
   "kind": "news",
   "title": "FOMO Web Users Face Bookmark Phishing Attack That Steals Crypto",
   "url": "https://www.tokenpost.com/news/technology/27682",
   "publisher": "TokenPost",
   "date": "2026-10-07"
  },
  {
   "kind": "news",
   "title": "SlowMist founder warns of bookmark phishing targeting FOMO web users",
   "url": "https://www.odaily.news/en/newsflash/523093",
   "publisher": "Odaily",
   "date": "2026-10-08"
  }
 ],
 "indicators": {
  "domains": [
   "voltage[.]family"
  ],
  "addresses": [
   "D783JqupQ2FYhkxUfGEd1gaFEoAJDXRX1NEb4aVH2hZ6"
  ]
 },
 "brief": "## Am I affected?\nYou may be affected if you use Fomo on the web and, on any page, dragged an icon or button to your bookmarks bar and clicked it as a 'verification' or CAPTCHA step. Check your bookmarks bar for entries you did not make yourself, such as one named 'Triple click to verify'. Opening the phishing page alone does not run it; clicking the bookmark on a logged-in page does.\n\n## What to do now\n- Delete the suspicious bookmark.\n- From a trusted device, log out of all Fomo sessions and revoke any sessions you can see, then turn on MFA.\n- Check the security of the Google or other account you log in with; changing a password may not end existing sessions.\n- Move remaining funds to a fresh wallet, and keep the page URL, bookmark and transaction records for investigators.\n\n## How to avoid this\n- Real human verification never asks you to drag anything to your bookmarks bar or click a bookmark on a wallet or trading page. Stop at once if asked.\n- Treat 'website' links on token pages as untrusted; anyone can set them.\n- Keep MFA on, and keep only what you are actively trading in an embedded trading wallet.",
 "notes": null,
 "agentBrief": "# Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet\n\n- Severity: Medium · Status: Still active (live)\n- Chains: Solana · Method: Bookmarklet drains\n- Started: Oct 8, 2026 · Last update: Oct 8, 2026 · Reported stolen: $48K · Victims: 1\n- Who/what: Fomo web app users (Privy embedded wallets)\n\nA Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds.\n\n## Am I affected?\nYou may be affected if you use Fomo on the web and, on any page, dragged an icon or button to your bookmarks bar and clicked it as a 'verification' or CAPTCHA step. Check your bookmarks bar for entries you did not make yourself, such as one named 'Triple click to verify'. Opening the phishing page alone does not run it; clicking the bookmark on a logged-in page does.\n\n## What to do now\n- Delete the suspicious bookmark.\n- From a trusted device, log out of all Fomo sessions and revoke any sessions you can see, then turn on MFA.\n- Check the security of the Google or other account you log in with; changing a password may not end existing sessions.\n- Move remaining funds to a fresh wallet, and keep the page URL, bookmark and transaction records for investigators.\n\n## How to avoid this\n- Real human verification never asks you to drag anything to your bookmarks bar or click a bookmark on a wallet or trading page. Stop at once if asked.\n- Treat 'website' links on token pages as untrusted; anyone can set them.\n- Keep MFA on, and keep only what you are actively trading in an embedded trading wallet.\n\n## Indicators (block these, never visit them)\n- Domain: voltage[.]family\n- Address: D783JqupQ2FYhkxUfGEd1gaFEoAJDXRX1NEb4aVH2hZ6\n\n## Sources\n- Threat Intelligence | Analysis of a Malicious Bookmark Phishing Attack Targeting Fomo Users (SlowMist, 2026-10-08): https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36\n- SlowMist TI Alert: bookmark-based phishing attacks targeting the Fomo web interface (SlowMist (X), 2026-10-08): https://x.com/SlowMist_Team/status/2108039792219013578\n- SlowMist analysis thread on the Fomo bookmark phishing attack (SlowMist (X), 2026-10-08): https://x.com/SlowMist_Team/status/2108169316025893169\n- FOMO Web Users Face Bookmark Phishing Attack That Steals Crypto (TokenPost, 2026-10-07): https://www.tokenpost.com/news/technology/27682\n- SlowMist founder warns of bookmark phishing targeting FOMO web users (Odaily, 2026-10-08): https://www.odaily.news/en/newsflash/523093\n\nFull record: https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026 · JSON: https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}