# Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet

- Severity: Medium · Status: Still active (live)
- Chains: Solana · Method: Bookmarklet drains
- Started: Oct 8, 2026 · Last update: Oct 8, 2026 · Reported stolen: $48K · Victims: 1
- Who/what: Fomo web app users (Privy embedded wallets)

A Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds.

## Am I affected?
You may be affected if you use Fomo on the web and, on any page, dragged an icon or button to your bookmarks bar and clicked it as a 'verification' or CAPTCHA step. Check your bookmarks bar for entries you did not make yourself, such as one named 'Triple click to verify'. Opening the phishing page alone does not run it; clicking the bookmark on a logged-in page does.

## What to do now
- Delete the suspicious bookmark.
- From a trusted device, log out of all Fomo sessions and revoke any sessions you can see, then turn on MFA.
- Check the security of the Google or other account you log in with; changing a password may not end existing sessions.
- Move remaining funds to a fresh wallet, and keep the page URL, bookmark and transaction records for investigators.

## How to avoid this
- Real human verification never asks you to drag anything to your bookmarks bar or click a bookmark on a wallet or trading page. Stop at once if asked.
- Treat 'website' links on token pages as untrusted; anyone can set them.
- Keep MFA on, and keep only what you are actively trading in an embedded trading wallet.

## Indicators (block these, never visit them)
- Domain: voltage[.]family
- Address: D783JqupQ2FYhkxUfGEd1gaFEoAJDXRX1NEb4aVH2hZ6

## Sources
- Threat Intelligence | Analysis of a Malicious Bookmark Phishing Attack Targeting Fomo Users (SlowMist, 2026-10-08): https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36
- SlowMist TI Alert: bookmark-based phishing attacks targeting the Fomo web interface (SlowMist (X), 2026-10-08): https://x.com/SlowMist_Team/status/2108039792219013578
- SlowMist analysis thread on the Fomo bookmark phishing attack (SlowMist (X), 2026-10-08): https://x.com/SlowMist_Team/status/2108169316025893169
- FOMO Web Users Face Bookmark Phishing Attack That Steals Crypto (TokenPost, 2026-10-07): https://www.tokenpost.com/news/technology/27682
- SlowMist founder warns of bookmark phishing targeting FOMO web users (Odaily, 2026-10-08): https://www.odaily.news/en/newsflash/523093

Full record: https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026 · JSON: https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.