{
 "tag": "fake-captcha",
 "name": "Fake Captcha",
 "group": "Other",
 "incidents": [
  {
   "slug": "fomo-bookmarklet-fake-verification-oct-2026",
   "title": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026",
   "json": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "bookmarklet",
   "product": "Fomo web app users (Privy embedded wallets)",
   "tags": [
    "solana",
    "bookmarklet",
    "fomo",
    "privy",
    "embedded-wallet",
    "session-hijack",
    "fake-captcha",
    "fake-verification",
    "token-page-link",
    "slowmist",
    "privacy-cash"
   ],
   "amountUsd": 48000,
   "victims": 1,
   "startedAt": "2026-10-08",
   "closedAt": null,
   "updatedAt": "2026-10-08T12:00:00Z",
   "summary": "A Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds."
  },
  {
   "slug": "sigma-telegram-bot-wallets-key-leak-200k-may-2026",
   "title": "Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak",
   "url": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026",
   "json": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "base",
    "bsc"
   ],
   "method": "key-leak",
   "product": "SIGMA Telegram trading bot wallets (one trader)",
   "tags": [
    "ethereum",
    "base",
    "bsc",
    "key-leak",
    "sigma",
    "telegram-bot",
    "trading-bot",
    "private-key",
    "fake-captcha"
   ],
   "amountUsd": 200000,
   "victims": 1,
   "startedAt": "2026-05-11",
   "closedAt": "2026-05-11",
   "updatedAt": "2026-05-11T12:00:00Z",
   "summary": "On 11 May 2026 a crypto trader lost over $200,000 across Ethereum, Base and BSC from two wallets created by the SIGMA Telegram trading bot; the largest losses were about $125,000 in POD on Base and $21,000 in FHE on BSC. An on-chain analyst said the drain used the private keys directly, with no token approval involved, while the victim's other wallets were untouched. The cause is unconfirmed; suggestions include fake CAPTCHA bots in Telegram, infostealer malware or a device compromise. Users of bot-generated wallets should keep balances small and never run 'verification' steps a Telegram bot asks for."
  }
 ],
 "changes": [
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist founder Cos warned on X of bookmark phishing aimed at the Fomo web app, using a fake CAPTCHA and a bookmark clicked two to three times.",
   "sourceUrl": "https://x.com/evilcos/status/2108000520493490578",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist posted a threat-intel alert saying the technique is an old one now being used against Fomo users.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/2108039792219013578",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist published its analysis: about $48,000 lost after a link on the MOONLET token page led to a fake verification page; 45,106.85 USDC went to one attacker address in three transfers.",
   "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist said MistTrack traced the funds through USDC/SOL swaps, address splitting, cross-chain transfers, Privacy Cash and gambling platforms.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/2108169316025893169",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "sigma-telegram-bot-wallets-key-leak-200k-may-2026",
   "incidentTitle": "Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-05-11",
   "title": "A trader reported two SIGMA-generated wallets drained of over $200,000 on Ethereum, Base and BSC; analysts pointed to a private-key leak.",
   "sourceUrl": "https://www.cryptopolitan.com/crypto-trader-loses-200k-telegram-bot/",
   "url": "https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026"
  }
 ]
}