{
 "tag": "embedded-wallet",
 "name": "Embedded Wallet",
 "group": "Other",
 "incidents": [
  {
   "slug": "fomo-bookmarklet-fake-verification-oct-2026",
   "title": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026",
   "json": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "bookmarklet",
   "product": "Fomo web app users (Privy embedded wallets)",
   "tags": [
    "solana",
    "bookmarklet",
    "fomo",
    "privy",
    "embedded-wallet",
    "session-hijack",
    "fake-captcha",
    "fake-verification",
    "token-page-link",
    "slowmist",
    "privacy-cash"
   ],
   "amountUsd": 48000,
   "victims": 1,
   "startedAt": "2026-10-08",
   "closedAt": null,
   "updatedAt": "2026-10-08T12:00:00Z",
   "summary": "A Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds."
  },
  {
   "slug": "bookmarklet-drains-solana-trading-terminals-wave",
   "title": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave",
   "json": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "bookmarklet",
   "product": "Users of web-based Solana memecoin trading apps (reported: Axiom, Fomo)",
   "tags": [
    "solana",
    "bookmarklet",
    "campaign",
    "axiom",
    "fomo",
    "trading-terminal",
    "embedded-wallet",
    "session-hijack",
    "fake-verification",
    "drainer-tooling"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-12-26",
   "closedAt": null,
   "updatedAt": "2026-10-08T12:00:00Z",
   "summary": "Since at least late 2025, scammers have used fake tools and fake 'verification' steps to get Solana memecoin traders to drag a bookmark into their browser and click it on a trading site they are logged in to, where it takes the session or wallet data and the account is drained. Reports cover Axiom traders in December 2025 and a Fomo user who lost about $48,000 in October 2026; SlowMist called it an old method being reused. In September 2026 Socket found theft code in malicious extensions labelled as Axiom bookmarklet tooling and noted that Axiom bookmark drainers circulate publicly. Traders on any web terminal should refuse any bookmark from others, use MFA and keep trading wallets small."
  }
 ],
 "changes": [
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist founder Cos warned on X of bookmark phishing aimed at the Fomo web app, using a fake CAPTCHA and a bookmark clicked two to three times.",
   "sourceUrl": "https://x.com/evilcos/status/2108000520493490578",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist posted a threat-intel alert saying the technique is an old one now being used against Fomo users.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/2108039792219013578",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist published its analysis: about $48,000 lost after a link on the MOONLET token page led to a fake verification page; 45,106.85 USDC went to one attacker address in three transfers.",
   "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist said MistTrack traced the funds through USDC/SOL swaps, address splitting, cross-chain transfers, Privacy Cash and gambling platforms.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/2108169316025893169",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "bookmarklet-drains-solana-trading-terminals-wave",
   "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist warned of bookmark phishing against Fomo users, calling it an old exploitation method, and published an analysis of a $48,000 loss.",
   "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave"
  },
  {
   "incident": "bookmarklet-drains-solana-trading-terminals-wave",
   "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-09",
   "title": "Socket reported malicious Chrome and Firefox extensions stealing trading-terminal session and wallet data, with code labelled as Axiom bookmarklet tooling.",
   "sourceUrl": "https://socket.dev/blog/chrome-firefox-crypto-data-theft",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave"
  },
  {
   "incident": "bookmarklet-drains-solana-trading-terminals-wave",
   "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2025-12-26",
   "title": "X users warned of the 'Axiom Bookmark Method', with a trending summary claiming over $200,000 drained.",
   "sourceUrl": "https://x.com/insidecalls/status/2004593677138550834",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave"
  }
 ]
}