{
 "tag": "campaign",
 "name": "Campaign",
 "group": "Other",
 "incidents": [
  {
   "slug": "bookmarklet-drains-solana-trading-terminals-wave",
   "title": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave",
   "json": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "bookmarklet",
   "product": "Users of web-based Solana memecoin trading apps (reported: Axiom, Fomo)",
   "tags": [
    "solana",
    "bookmarklet",
    "campaign",
    "axiom",
    "fomo",
    "trading-terminal",
    "embedded-wallet",
    "session-hijack",
    "fake-verification",
    "drainer-tooling"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-12-26",
   "closedAt": null,
   "updatedAt": "2026-10-08T12:00:00Z",
   "summary": "Since at least late 2025, scammers have used fake tools and fake 'verification' steps to get Solana memecoin traders to drag a bookmark into their browser and click it on a trading site they are logged in to, where it takes the session or wallet data and the account is drained. Reports cover Axiom traders in December 2025 and a Fomo user who lost about $48,000 in October 2026; SlowMist called it an old method being reused. In September 2026 Socket found theft code in malicious extensions labelled as Axiom bookmarklet tooling and noted that Axiom bookmark drainers circulate publicly. Traders on any web terminal should refuse any bookmark from others, use MFA and keep trading wallets small."
  }
 ],
 "changes": [
  {
   "incident": "bookmarklet-drains-solana-trading-terminals-wave",
   "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist warned of bookmark phishing against Fomo users, calling it an old exploitation method, and published an analysis of a $48,000 loss.",
   "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave"
  },
  {
   "incident": "bookmarklet-drains-solana-trading-terminals-wave",
   "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-09",
   "title": "Socket reported malicious Chrome and Firefox extensions stealing trading-terminal session and wallet data, with code labelled as Axiom bookmarklet tooling.",
   "sourceUrl": "https://socket.dev/blog/chrome-firefox-crypto-data-theft",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave"
  },
  {
   "incident": "bookmarklet-drains-solana-trading-terminals-wave",
   "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2025-12-26",
   "title": "X users warned of the 'Axiom Bookmark Method', with a trending summary claiming over $200,000 drained.",
   "sourceUrl": "https://x.com/insidecalls/status/2004593677138550834",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave"
  }
 ]
}