{
 "tag": "multi-evm",
 "name": "Multiple EVM chains",
 "group": "Chains",
 "incidents": [
  {
   "slug": "noir-drainer-dns-txt-c2-oct-2026",
   "title": "Noir wallet drainer kit hides its backend behind DNS TXT records and DoH",
   "url": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026",
   "json": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Infoblox says it seems likely the Noir drainer kit is created and maintained with AI assistance, based on its verbose explanatory code comments, while noting a human could also have written it."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "drainer-kit",
   "product": "Users of Uniswap, Lido, Hyperliquid, Polymarket and other brands targeted by Noir lure pages",
   "tags": [
    "multi-evm",
    "drainer-kit",
    "drainer-as-a-service",
    "noir-drainer",
    "dns-txt",
    "doh",
    "cloudflare-pages",
    "netlify",
    "walletconnect",
    "fake-airdrop",
    "infoblox",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-09",
   "closedAt": null,
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "Infoblox Threat Intel described Noir on 9 October 2026, a wallet-drainer kit that looks up its backend pool through DNS TXT records over public DNS-over-HTTPS, so operators can repoint every lure page by changing one record. Lures impersonate CoinMarketCap, DexScreener, OKX, Uniswap, Lido, Hyperliquid, Morpho, Ondo, LayerZero, MegaETH, Polymarket and others with fake votes, airdrop checks and swap clones. It steals by getting token spending permissions, then cuts the WalletConnect session to hide the trail. Infoblox gave no loss figures and says the kit was likely AI-developed."
  },
  {
   "slug": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "title": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "json": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "malicious-extension",
   "product": "Firefox users who installed fake Rabby Wallet or OKX Wallet add-ons",
   "tags": [
    "multi-evm",
    "malicious-extension",
    "firefox",
    "browser-extension",
    "fake-wallet",
    "rabby",
    "okx-wallet",
    "seed-phrase-theft",
    "socket"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-05",
   "closedAt": null,
   "updatedAt": "2026-10-07T12:00:00Z",
   "summary": "Socket found 16 Firefox extensions posing as Rabby Wallet (branded 'Raabby WaIIet') and OKX Wallet ('Portal WALLET'). They captured 12- or 24-word recovery phrases and private keys during the wallet import step and sent them to attacker-run Cloudflare Workers. Mozilla removed them by 5 October 2026, but Socket links them to a crypto-theft extension campaign it first saw in August 2026, so new copies may appear. No loss figure has been published; anyone who imported a seed into one of them should treat that wallet as stolen."
  },
  {
   "slug": "address-poisoning-305k-dai-oct-2026",
   "title": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026",
   "json": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "address-poisoning",
   "product": "A DAI holder sending to a regular counterparty",
   "tags": [
    "multi-evm",
    "address-poisoning",
    "dust-attack",
    "lookalike-address",
    "dai",
    "stablecoin",
    "goplus"
   ],
   "amountUsd": 305000,
   "victims": 1,
   "startedAt": "2026-10-04",
   "closedAt": null,
   "updatedAt": "2026-10-05T12:00:00Z",
   "summary": "On 4 October 2026 GoPlus Security flagged a loss of about $305,000 in DAI. The attacker made an address with the same first and last characters as the victim's usual recipient, sent dust transfers so it appeared in the victim's history, and the victim copied it for a large transfer. GoPlus warned these campaigns are now fully automated, from finding targets to laundering. Reports did not name the chain."
  },
  {
   "slug": "waterplum-contagious-interview-advisory-sep-2026",
   "title": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets",
   "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026",
   "json": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "The attackers reportedly use AI face-swapping software during online job interviews, then turn off their cameras and blame network problems."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Crypto, AI and NFT developers and job seekers",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "waterplum",
    "contagious-interview",
    "fake-job-interview",
    "npm",
    "vscode",
    "beavertail",
    "invisibleferret",
    "ottercookie",
    "stoatwaffle",
    "infostealer",
    "ai"
   ],
   "amountUsd": 10710000,
   "victims": 7000,
   "startedAt": "2026-09-18",
   "closedAt": null,
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "On 18 September 2026 Japanese, US, Australian and German authorities warned that the North Korean group WaterPlum, linked to the 'Contagious Interview' campaign, infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026. Posing as AI, crypto or NFT firms and recruiters, they get targets to run code during fake interviews and coding tests, including malicious npm packages and VS Code projects, then steal private keys, seed phrases and passwords. Funds or credentials were taken from over 7,000 wallets, and more than 1.7 billion yen (about $10.71M) went to North Korea. The advisory does not say the campaign has stopped."
  },
  {
   "slug": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "title": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "json": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Trezor, BitBox and CoinTracking newsletter subscribers",
   "tags": [
    "bitcoin",
    "multi-evm",
    "social-engineering",
    "email-phishing",
    "seed-phishing",
    "hardware-wallet",
    "trezor",
    "bitbox",
    "cointracking",
    "brevo",
    "newsletter"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-09-09",
   "closedAt": "2026-09-11",
   "updatedAt": "2026-09-11T12:00:00Z",
   "summary": "An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses."
  },
  {
   "slug": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "title": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "json": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm",
    "solana",
    "tron"
   ],
   "method": "malicious-extension",
   "product": "Users of 19 Chrome/Edge extensions incl. 'Enable Right Click & Copy', 'Multi-Chain Explorer' and 'LedgerLook: Wallet Checker'",
   "tags": [
    "multi-evm",
    "solana",
    "tron",
    "malicious-extension",
    "chrome",
    "edge",
    "browser-extension",
    "extension-takeover",
    "seed-phishing",
    "clickfix",
    "ledger",
    "trezor",
    "metamask",
    "socket"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-08-30",
   "closedAt": null,
   "updatedAt": "2026-08-30T12:00:00Z",
   "summary": "Socket found 19 Chrome and Edge extensions, from crypto price trackers and explorers to general tools like 'Enable Right Click & Copy' (70,000+ Chrome users), that loaded a modular malware framework. It drained EVM, Solana and Tron wallets by hijacking 'Connect Wallet' and 'Swap' buttons, swapped Ledger and Trezor sites for seed-phishing pages and stole exchange sessions; five extensions were bought from their original developers and turned malicious through updates. Socket thinks the campaign may date back to early 2024. Google removed the Chrome listings, but when BleepingComputer reported it on 30 August 2026 the Edge version of one was still available."
  },
  {
   "slug": "eip-7702-usenix-study-malicious-delegations-aug-2026",
   "title": "USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts",
   "url": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026",
   "json": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026.json",
   "status": "live",
   "severity": "low",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "eip-7702-phishing",
   "product": "Users of EIP-7702 smart accounts on Ethereum and other EVM chains",
   "tags": [
    "multi-evm",
    "eip-7702-phishing",
    "eip-7702",
    "research",
    "usenix",
    "sweeper",
    "smart-account",
    "advisory"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-08-01",
   "closedAt": null,
   "updatedAt": "2026-08-01T12:00:00Z",
   "summary": "A peer-reviewed study presented at USENIX Security '26 (August 2026) found 924 malicious contract accounts across seven chains that support EIP-7702, with more than $2.3 million in losses and over 10 million users exposed. The authors say over 63% of authorization transactions in their data were linked to attacks on regular wallets, and nearly half of the most-authorized contracts were attacker-controlled. The study window ends in mid-2025, so it measures early abuse, not today's rate. It confirms that 7702 delegation is a major phishing and key-theft sweep vector."
  },
  {
   "slug": "zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "title": "Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments",
   "url": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "json": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026.json",
   "status": "closed",
   "severity": "low",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The pages carry hidden instructions written for AI agents, telling them to make crypto payments or to trust a fake DeBank site."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "agent-hijack",
   "product": "AI agents that browse the web and can pay",
   "tags": [
    "multi-evm",
    "agent-hijack",
    "prompt-injection",
    "ai-agent",
    "agent-payments",
    "seo-poisoning",
    "typosquat",
    "debank",
    "zscaler",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-07-06",
   "closedAt": "2026-07-06",
   "updatedAt": "2026-07-06T12:00:00Z",
   "summary": "SecurityWeek reported on 6 July 2026 that Zscaler found two campaigns in use that plant hidden instructions on web pages for AI agents that can browse and pay. One used SEO poisoning to lure agents searching for a fake Python package, requests-secure-v2, backed by 10 GitHub repositories; the other typosquatted the DeFi portfolio tracker DeBank. In Zscaler's own tests 4 of 26 models were manipulated into making a payment and 2 mistook the fake DeBank site for the real one. No real losses were reported, but agents with spending power should only pay allow-listed recipients."
  },
  {
   "slug": "fake-exchange-unlimited-approval-1-65m-jul-2026",
   "title": "Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange",
   "url": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026",
   "json": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "approval-phishing",
   "product": "A crypto wallet holder using a fake exchange site",
   "tags": [
    "multi-evm",
    "approval-phishing",
    "unlimited-approval",
    "fake-exchange",
    "sweeper",
    "phishing"
   ],
   "amountUsd": 1650000,
   "victims": 1,
   "startedAt": "2026-07-03",
   "closedAt": "2026-07-09",
   "updatedAt": "2026-07-09T12:00:00Z",
   "summary": "In early July 2026 a crypto wallet holder connected to a fake exchange site and signed a malicious contract approval that gave the attacker unlimited spending rights. An automated sweeper then emptied the wallet of about $1.65 million. Anyone who signs approvals on unfamiliar trading sites is at risk; check and revoke token approvals you do not recognise."
  },
  {
   "slug": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "title": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026",
   "json": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "npm package @injectivelabs/sdk-ts and 17 related @injectivelabs packages",
   "tags": [
    "multi-evm",
    "supply-chain",
    "npm",
    "injective",
    "sdk",
    "github-compromise",
    "seed-phrase-theft",
    "developer"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-06-08",
   "closedAt": "2026-07-09",
   "updatedAt": "2026-07-09T12:00:00Z",
   "summary": "Attackers who compromised Injective Labs' GitHub repository published @injectivelabs/sdk-ts 1.20.21 to npm, along with 17 related @injectivelabs packages pinned to it. The malicious build hooked the fromMnemonic and fromHex functions and sent seed phrases and private keys to an Injective-looking endpoint whenever an app used them. It was downloaded about 310 times before being deprecated; no thefts had been reported. Any key or seed that passed through 1.20.21 should be treated as stolen; the clean version is 1.20.23."
  },
  {
   "slug": "trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "title": "TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools",
   "url": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "json": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The packages planted .cursorrules and CLAUDE.md files with hidden Unicode instructions meant to trick AI coding assistants into running steps that could find and exfiltrate secrets."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "Developers installing packages from npm, PyPI and Crates.io",
   "tags": [
    "multi-evm",
    "supply-chain",
    "trapdoor",
    "npm",
    "pypi",
    "crates-io",
    "ai-coding-agent",
    "cursor",
    "claude-code",
    "hidden-unicode",
    "infostealer",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-05-26",
   "closedAt": "2026-05-26",
   "updatedAt": "2026-05-26T12:00:00Z",
   "summary": "Socket reported in late May 2026 a campaign it named TrapDoor: more than 34 malicious packages and 384+ related versions across npm, PyPI and Crates.io that steal crypto wallet data and other developer secrets. The packages also tried to alter files that AI coding tools read, such as .cursorrules and CLAUDE.md, using hidden Unicode instructions meant to get the assistant to run scan-like steps that find and send out secrets. No confirmed losses or victim counts have been published. Developers who installed flagged packages should rotate credentials and move wallet funds."
  },
  {
   "slug": "femitbot-telegram-mini-app-fraud-may-2026",
   "title": "FEMITBOT: fake Telegram bots and Mini Apps impersonate crypto brands to take deposits and push Android malware",
   "url": "https://drains.watch/i/femitbot-telegram-mini-app-fraud-may-2026",
   "json": "https://drains.watch/i/femitbot-telegram-mini-app-fraud-may-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "fake-telegram-bot",
   "product": "Telegram users targeted with fake crypto and investment bots (impersonating MoonPay and other brands)",
   "tags": [
    "multi-evm",
    "fake-telegram-bot",
    "telegram",
    "telegram-mini-app",
    "fake-bot",
    "femitbot",
    "investment-scam",
    "android-malware",
    "brand-impersonation",
    "moonpay"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-05-03",
   "closedAt": "2026-05-03",
   "updatedAt": "2026-05-03T12:00:00Z",
   "summary": "CTM360 found a shared fraud platform, FEMITBOT, behind many Telegram bots that open Mini App phishing pages inside Telegram, impersonating crypto services such as MoonPay (other outlets also list Bitget, OKX, Binance and Fragment) plus streaming and AI brands. Victims see fake balances and earnings and are told to deposit money or recruit others to 'unlock' withdrawals; some Mini Apps also push Android APK malware. No total losses have been published. Do not start bots or open Mini Apps from ads or unsolicited invites, and never pay to withdraw 'earnings'."
  },
  {
   "slug": "kaspersky-fakewallet-26-ios-apps-apr-2026",
   "title": "Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases",
   "url": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026",
   "json": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm",
    "bitcoin",
    "tron"
   ],
   "method": "fake-app",
   "product": "iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps",
   "tags": [
    "multi-evm",
    "bitcoin",
    "tron",
    "fake-app",
    "ios",
    "app-store",
    "kaspersky",
    "sparkkitty",
    "metamask",
    "ledger",
    "trust-wallet",
    "coinbase",
    "seed-phrase",
    "developer-profile"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-04-20",
   "closedAt": "2026-04-20",
   "updatedAt": "2026-04-20T12:00:00Z",
   "summary": "Kaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published."
  },
  {
   "slug": "notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "title": "notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies",
   "url": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "json": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "fake-app",
   "product": "Mac users with Ledger Live, Trezor Suite or desktop/extension wallets",
   "tags": [
    "bitcoin",
    "multi-evm",
    "fake-app",
    "macos",
    "infostealer",
    "ledger",
    "trezor",
    "clickfix",
    "google-ads",
    "youtube",
    "moonlock",
    "notnullosx"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-04-10",
   "closedAt": "2026-04-10",
   "updatedAt": "2026-04-10T12:00:00Z",
   "summary": "Moonlock found notnullOSX, a macOS stealer spread through Google Ads, promoted YouTube videos and fake wallpaper sites using ClickFix-style 'paste this in Terminal' instructions. Its ReplaceApp module replaces the user's Ledger Live or Trezor app with a trojanized copy to catch the recovery phrase, and it also copies desktop and browser-extension wallet data. Operators reportedly target people holding more than $10,000 in crypto. No loss total was published."
  },
  {
   "slug": "litellm-pypi-teampcp-credential-wallet-stealer-mar-2026",
   "title": "Compromised LiteLLM releases on PyPI steal cloud keys and crypto wallet data from AI developers",
   "url": "https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026",
   "json": "https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The trojanized package was LiteLLM, a gateway library used to connect AI apps and agents to LLMs, so an AI tool was the delivery route; no AI model was manipulated."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "LiteLLM on PyPI",
   "tags": [
    "multi-evm",
    "supply-chain",
    "litellm",
    "pypi",
    "teampcp",
    "llm-gateway",
    "ai-tooling",
    "infostealer",
    "trivy",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-03-24",
   "closedAt": "2026-03-24",
   "updatedAt": "2026-03-24T12:00:00Z",
   "summary": "On 24 March 2026 attackers tracked as TeamPCP published LiteLLM 1.82.7 and 1.82.8 to PyPI with hidden code that runs on import, and in 1.82.8 whenever Python starts. LiteLLM is a popular open-source gateway that AI apps and agents use to reach many LLM providers, with over 3.4 million downloads a day. The payload collected SSH keys, cloud credentials, Kubernetes secrets, .env files and crypto wallet data and sent them to a lookalike domain. Both versions were removed; anyone who installed them should rotate secrets and move funds from wallets on affected machines."
  },
  {
   "slug": "inferno-angelferno-drainer-still-active-oct-2026",
   "title": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026",
   "json": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "drainer-kit",
   "product": "Web3 users targeted by Inferno/AngelFerno affiliate phishing sites and domain takeovers",
   "tags": [
    "multi-evm",
    "drainer-kit",
    "drainer-as-a-service",
    "inferno-drainer",
    "angel-drainer",
    "angelferno",
    "purple-drainer",
    "permit2",
    "cloudflare-workers",
    "ransom-isac"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-03-01",
   "closedAt": null,
   "updatedAt": "2026-10-05T12:00:00Z",
   "summary": "A Ransom-ISAC report published on 5 October 2026 says the Inferno drainer ecosystem, now branded AngelFerno after merging with Angel Drainer, was still running in summer 2026 with thousands of affiliates. It says AngelFerno announced it had bought Purple Drainer in March 2026, that its factory has deployed over 17,000 single-use drainer contracts, and that it targets 165 tokens on 11 EVM chains (with Solana, TRON, SUI and XRP variants). The report ties it to domain takeovers including CoW Protocol in April 2026 (about $1.2M lost) and notes a May 2026 key rotation that locked the operators out of their own command contract for about 23 days."
  },
  {
   "slug": "arkanix-stealer-llm-assisted-crypto-wallets-feb-2026",
   "title": "Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down",
   "url": "https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026",
   "json": "https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026.json",
   "status": "closed",
   "severity": "low",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Kaspersky says the stealer contains probable traces of LLM-assisted development and was likely an AI-assisted experiment."
   },
   "chains": [
    "multi-evm"
   ],
   "method": null,
   "product": "People infected with the Arkanix stealer (Exodus, Atomic and browser wallet users)",
   "tags": [
    "multi-evm",
    "infostealer",
    "malware-as-a-service",
    "arkanix",
    "exodus",
    "atomic-wallet",
    "llm-assisted",
    "kaspersky",
    "discord",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-24",
   "closedAt": "2026-02-24",
   "updatedAt": "2026-02-24T12:00:00Z",
   "summary": "Kaspersky analysed Arkanix, a malware-as-a-service info-stealer advertised on dark-web forums and Discord from October 2025, as Security Affairs reported on 24 February 2026. It took crypto wallet data, with paid builds offering injection into Exodus and Atomic wallets, along with browser passwords, cookies, Telegram sessions and Discord logins. Kaspersky says the code shows probable traces of LLM-assisted development, and the operators shut the project down about two months after launch. No victim counts or losses were published."
  },
  {
   "slug": "unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "title": "North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech",
   "url": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "json": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "The victim reported an apparent deepfake video of a crypto CEO on the call; Mandiant could not verify it forensically but notes UNC1069's known use of AI tools to edit images or video and of Gemini for tooling and research."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Crypto and DeFi fintech staff on macOS",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "unc1069",
    "masan",
    "cryptocore",
    "deepfake",
    "zoom",
    "fake-meeting",
    "clickfix",
    "telegram",
    "calendly",
    "macos",
    "mandiant",
    "gemini",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1,
   "startedAt": "2026-02-09",
   "closedAt": "2026-02-09",
   "updatedAt": "2026-02-09T12:00:00Z",
   "summary": "Mandiant reported on 9 February 2026 an intrusion at a crypto-sector fintech that began with a message from a crypto executive's hijacked Telegram account and a Calendly invite to a spoofed Zoom meeting. On the call the victim saw what appeared to be a deepfake of another crypto company's CEO, was told their audio was broken and was talked into running 'troubleshooting' commands (ClickFix). Those commands installed seven malware families on macOS that collect credentials, browser and Telegram data to enable crypto theft. Mandiant tied it to the North Korea-linked group UNC1069 and reported no stolen amount."
  },
  {
   "slug": "openclaw-clawhub-malicious-skills-solana-phantom-feb-2026",
   "title": "Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys",
   "url": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026",
   "json": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "Malicious skills for the OpenClaw AI agent posed as Solana, Phantom and other crypto tools; some delivered the AMOS stealer and Solana keys were exposed in plain-text keypair files."
   },
   "chains": [
    "solana",
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "OpenClaw (ClawHub) skill users",
   "tags": [
    "solana",
    "multi-evm",
    "supply-chain",
    "openclaw",
    "clawhub",
    "ai-agent",
    "skills",
    "amos-stealer",
    "macos",
    "infostealer",
    "phantom",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-05",
   "closedAt": null,
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "Bitdefender found that about 17% of the OpenClaw (ClawHub) AI-agent skills it analyzed in the first week of February 2026 behaved maliciously. Solana-themed skills made up 9.3% of the malicious set and Phantom-wallet skills 8.2%. Some skills told users to run fake installers that dropped the AMOS macOS stealer. Solana skills that read SOLANA_KEYPAIR_PATH can expose the plain-text keypair file that holds a wallet's private key. Payloads were staged on 91.92.242[.]30 and an impersonated OpenClaw GitHub repo. Anyone who installed crypto skills and ran their setup commands should move funds to a new wallet."
  },
  {
   "slug": "konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "title": "North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor",
   "url": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "json": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Check Point Research describes the payload as an AI-generated PowerShell backdoor."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Blockchain and crypto developers and engineering teams (Asia-Pacific)",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "konni",
    "powershell",
    "backdoor",
    "ai-generated-code",
    "blockchain-developers",
    "phishing",
    "check-point",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-01-22",
   "closedAt": "2026-01-22",
   "updatedAt": "2026-01-22T12:00:00Z",
   "summary": "Check Point Research reported on 22 January 2026 that the North Korea-linked group KONNI, long focused on South Korean government targets, is now going after developers and engineering teams on blockchain and crypto projects. Phishing lures dressed up as project documentation deliver a PowerShell backdoor that Check Point calls AI-generated, with activity seen in Japan, Australia and India. A compromised developer can expose source code, infrastructure and blockchain credentials. No losses were reported."
  },
  {
   "slug": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "title": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "json": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "fake-app",
   "product": "Linux users installing wallet apps from the Snap Store",
   "tags": [
    "bitcoin",
    "multi-evm",
    "fake-app",
    "linux",
    "snap-store",
    "snapcraft",
    "exodus",
    "ledger",
    "trust-wallet",
    "slowmist",
    "seed-phrase",
    "expired-domain",
    "account-takeover"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-01-21",
   "closedAt": "2026-01-21",
   "updatedAt": "2026-01-21T12:00:00Z",
   "summary": "SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published."
  },
  {
   "slug": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "title": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks",
   "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "json": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Kaspersky says generative AI has let BlueNoroff speed up malware development and refine its attack techniques; it describes the fake calls as replaying videos of earlier victims, not deepfakes."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Web3 and crypto executives, founders and blockchain developers",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "bluenoroff",
    "lazarus",
    "ghostcall",
    "ghosthire",
    "snatchcrypto",
    "fake-meeting",
    "fake-job-interview",
    "telegram",
    "github",
    "macos",
    "kaspersky",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-10-28",
   "closedAt": "2025-10-28",
   "updatedAt": "2025-10-28T12:00:00Z",
   "summary": "Kaspersky disclosed on 28 October 2025 two BlueNoroff campaigns aimed at Web3 and crypto organisations in India, Turkey, Australia and other countries in Europe and Asia, active since at least April 2025. GhostCall reaches executives and founders on Telegram with fake investor meetings, where an 'audio fix' installs malware; GhostHire sends blockchain developers fake job tests in GitHub repositories that hide malware. Kaspersky says generative AI has helped the group develop malware faster, and the payloads include crypto stealers. No loss figures were given."
  },
  {
   "slug": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "title": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "json": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "The malware ran locally installed AI CLIs (Claude, Gemini, Amazon Q) to inventory wallet, keystore and secret files for theft; Wiz found the AI step worked in under a quarter of cases and saw no successful crypto exfiltration."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "Nx build system on npm",
   "tags": [
    "multi-evm",
    "supply-chain",
    "nx",
    "npm",
    "s1ngularity",
    "ai-cli",
    "claude-code",
    "gemini-cli",
    "amazon-q",
    "keystore",
    "github-tokens",
    "github-actions",
    "infostealer",
    "wiz",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1700,
   "startedAt": "2025-08-26",
   "closedAt": "2025-09-06",
   "updatedAt": "2025-09-06T12:00:00Z",
   "summary": "Around 26 August 2025 malicious versions of Nx, a widely used JavaScript build tool, were published to npm and stole GitHub and npm tokens on install. The malware also looked for installed AI command-line tools (Claude, Gemini and Amazon Q) and ran them to search the disk for crypto wallet and keystore files, .env files and SSH keys, then published the results to repos in the victim's own GitHub account. Wiz counted over 1,700 users with leaked secrets and over 6,700 private repos made public, but saw no successful crypto theft, partly because the AI tools often refused. Anyone who installed the bad versions should rotate tokens and move funds from wallet files on that machine."
  },
  {
   "slug": "cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "title": "Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer",
   "url": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "json": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The malicious extension reached the victim through the extension marketplace used by Cursor, an AI-powered code editor; the AI features themselves were not exploited."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "Cursor AI code editor users (Open VSX extensions)",
   "tags": [
    "multi-evm",
    "supply-chain",
    "cursor",
    "ai-code-editor",
    "open-vsx",
    "malicious-extension",
    "solidity",
    "screenconnect",
    "quasar",
    "infostealer",
    "developers",
    "ai"
   ],
   "amountUsd": 500000,
   "victims": 1,
   "startedAt": "2025-07-10",
   "closedAt": "2025-07-10",
   "updatedAt": "2025-07-10T12:00:00Z",
   "summary": "Kaspersky reported on 10 July 2025 that a blockchain developer lost about $500,000 in crypto after installing a fake Solidity extension in Cursor, an AI code editor built on VS Code that gets extensions from the Open VSX registry. The extension gave no Solidity support; it installed ScreenConnect remote-access software, then the Quasar backdoor and a stealer that took browser, email and wallet data, including seed phrases. The attackers used the seed phrases to drain the developer's wallets. Developers should vet editor extensions and never keep seed phrases or funded keys on a coding machine."
  },
  {
   "slug": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "title": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025",
   "json": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Proofpoint says criminals are increasingly using the AI website builder Lovable to create and host phishing sites, and the Aave lure was a Lovable-built app."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "fake-airdrop-site",
   "product": "Aave and other DeFi users receiving fake reward emails",
   "tags": [
    "multi-evm",
    "fake-airdrop-site",
    "aave",
    "lovable",
    "ai-website-builder",
    "email-phishing",
    "sendgrid",
    "wallet-connect",
    "proofpoint",
    "drainer",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-06-17",
   "closedAt": "2025-08-20",
   "updatedAt": "2025-08-20T12:00:00Z",
   "summary": "Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published."
  },
  {
   "slug": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "title": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "json": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Huntress says the Zoom meeting contained several deepfakes of known senior leaders of the victim's company, used to make the call look genuine before the fake 'extension' install."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Crypto foundation staff on macOS",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "bluenoroff",
    "ta444",
    "lazarus",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "calendly",
    "macos",
    "cryptobot",
    "infostealer",
    "huntress",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1,
   "startedAt": "2025-06-11",
   "closedAt": "2025-06-18",
   "updatedAt": "2025-06-18T12:00:00Z",
   "summary": "Huntress reported on 18 June 2025 that an employee of a cryptocurrency foundation was contacted on Telegram, sent a Calendly invite and led to a fake Zoom domain. Weeks later the employee joined a group call that contained several deepfakes of the company's senior leadership; when 'audio problems' came up, they were told to install a Zoom extension that was really a malicious AppleScript. It installed a set of macOS backdoors, a keylogger and screen recorder, and a crypto-wallet stealer called CryptoBot. Huntress did not say whether funds were stolen."
  },
  {
   "slug": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "title": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025",
   "json": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Nailwal said the calls showed AI-generated videos of him, the Polygon Ventures lead and a supposed team member, used to get targets to install malware."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Startup founders in Polygon's investment network",
   "tags": [
    "multi-evm",
    "social-engineering",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "account-takeover",
    "polygon",
    "malware",
    "founders",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-05-13",
   "closedAt": "2025-05-14",
   "updatedAt": "2025-05-14T12:00:00Z",
   "summary": "On 13 May 2025 Polygon co-founder Sandeep Nailwal warned that attackers had taken over the Telegram account of the head of Polygon Ventures and were messaging startup founders in its network. Targets were invited to Zoom calls showing AI-generated video of Nailwal and other team members with no audio, and were urged to install an 'SDK' to fix the sound, which would infect their computers. No losses were reported. Do not install software during a call, even when the people on screen look like contacts you know."
  }
 ],
 "changes": [
  {
   "incident": "noir-drainer-dns-txt-c2-oct-2026",
   "incidentTitle": "Noir wallet drainer kit hides its backend behind DNS TXT records and DoH",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-09",
   "title": "Infoblox Threat Intel publishes its analysis of the Noir drainer kit and its DNS TXT based control channel.",
   "sourceUrl": "https://www.infoblox.com/blog/threat-intelligence/when-a-wallet-drainer-asks-dns-where-to-go/",
   "url": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026"
  },
  {
   "incident": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "incidentTitle": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "severity": "medium",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-07",
   "title": "Socket published its analysis, linking the add-ons through a shared campaign marker to crypto-theft extensions it found in August 2026.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026"
  },
  {
   "incident": "firefox-fake-rabby-okx-wallet-extensions-oct-2026",
   "incidentTitle": "16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys",
   "severity": "medium",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-10-05",
   "title": "Mozilla unpublished the 16 malicious extensions from the Firefox add-ons store.",
   "sourceUrl": "https://socket.dev/blog/firefox-crypto-wallet-stealers",
   "url": "https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026"
  },
  {
   "incident": "address-poisoning-305k-dai-oct-2026",
   "incidentTitle": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-05",
   "title": "Incrypted published the addresses involved: the poison address matched the intended recipient's first three and last six hex characters.",
   "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-05",
   "title": "Ransom-ISAC publishes 'Inferno Drainer Is Burning Out', describing the ecosystem as still active.",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "address-poisoning-305k-dai-oct-2026",
   "incidentTitle": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-04",
   "title": "GoPlus Security reported the roughly $305,000 DAI loss and warned that address-poisoning campaigns are now fully automated.",
   "sourceUrl": "https://phemex.com/news/article/user-loses-305000-in-dai-to-automated-address-poisoning-attack-98744",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026"
  },
  {
   "incident": "waterplum-contagious-interview-advisory-sep-2026",
   "incidentTitle": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-19",
   "title": "BleepingComputer reported the advisory's figures: 30,000+ infected devices, 7,000+ wallets hit and over 1.7 billion yen stolen.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/",
   "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026"
  },
  {
   "incident": "waterplum-contagious-interview-advisory-sep-2026",
   "incidentTitle": "Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-18",
   "title": "Japan, the US, Australia and Germany issued a joint advisory on WaterPlum covering activity from December 2025 to July 2026.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/",
   "url": "https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-11",
   "title": "Cointelegraph reported about 2,500 people opened the Trezor phishing link before it was taken down, with no losses reported.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-10",
   "title": "Brevo's postmortem said 138 client accounts were accessed, six used to send phishing and contacts exported from 43.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "brevo-flaw-trezor-bitbox-phishing-emails-sep-2026",
   "incidentTitle": "Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-09",
   "title": "Trezor and BitBox warned users about unauthorized emails sent through their Brevo accounts.",
   "sourceUrl": "https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing",
   "url": "https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026"
  },
  {
   "incident": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "incidentTitle": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "severity": "high",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-08-30",
   "title": "BleepingComputer reported Socket's discovery of 19 malicious Chrome and Edge extensions; the Chrome versions were gone but one Edge version was still live.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026"
  },
  {
   "incident": "eip-7702-usenix-study-malicious-delegations-aug-2026",
   "incidentTitle": "USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts",
   "severity": "low",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-01",
   "title": "USENIX Security '26 publishes the study reporting 924 malicious contract accounts and more than $2.3M in losses.",
   "sourceUrl": "https://www.usenix.org/conference/usenixsecurity26/presentation/huang-mingyuan",
   "url": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026"
  },
  {
   "incident": "fake-exchange-unlimited-approval-1-65m-jul-2026",
   "incidentTitle": "Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-09",
   "title": "ForkLog reported the case alongside a separate 999,999 USDT approval-phishing theft, noting the approval gave attackers unlimited access and a sweeper drained the funds.",
   "sourceUrl": "https://forklog.com/en/ethereum-user-loses-nearly-1-million-usdt-in-phishing-scam/",
   "url": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-09",
   "title": "Socket published its analysis: the payload hooks fromMnemonic and fromHex, 17 more packages pinned the bad version, the malicious release had 310 downloads, and 1.20.23 is clean.",
   "sourceUrl": "https://socket.dev/blog/compromised-injective-sdk-npm-package",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-09",
   "title": "BleepingComputer reported the compromise and advised affected developers to move funds to new wallets and rotate all secrets.",
   "sourceUrl": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "incidentTitle": "Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments",
   "severity": "low",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-06",
   "title": "SecurityWeek reported Zscaler's findings on two campaigns using hidden web instructions to push AI agents into crypto payments.",
   "sourceUrl": "https://www.securityweek.com/prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments/",
   "url": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026"
  },
  {
   "incident": "fake-exchange-unlimited-approval-1-65m-jul-2026",
   "incidentTitle": "Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-03",
   "title": "An X post by an on-chain commentator reported that a wallet holder lost $1.65M after connecting to a fake exchange and signing a malicious contract.",
   "sourceUrl": "https://x.com/RyanColeXBT/status/2073172860034789620",
   "url": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-08",
   "title": "The attacker made the first suspicious commits to the Injective SDK repository and published the malicious version shortly after.",
   "sourceUrl": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "incidentTitle": "TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-26",
   "title": "CSO Online reported Socket's TrapDoor findings: 34+ malicious packages across three registries that steal wallet data and poison AI assistant config files.",
   "sourceUrl": "https://www.csoonline.com/article/4177019/trapdoor-malware-campaign-puts-developer-workstations-in-ciso-spotlight.html",
   "url": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026"
  },
  {
   "incident": "femitbot-telegram-mini-app-fraud-may-2026",
   "incidentTitle": "FEMITBOT: fake Telegram bots and Mini Apps impersonate crypto brands to take deposits and push Android malware",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-05-03",
   "title": "BleepingComputer reports CTM360's findings on FEMITBOT, a shared backend running fake Telegram bots and Mini Apps for crypto scams and Android malware.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/telegram-mini-apps-abused-for-crypto-scams-android-malware-delivery/",
   "url": "https://drains.watch/i/femitbot-telegram-mini-app-fraud-may-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-05-01",
   "title": "A key rotation locks the operators out of their own command contract for about 23 days (month reported; day not given).",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "kaspersky-fakewallet-26-ios-apps-apr-2026",
   "incidentTitle": "Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-20",
   "title": "Kaspersky discloses 26 FakeWallet apps on the App Store, active since at least fall 2025, and reports them to Apple.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets",
   "url": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-04-14",
   "title": "CoW Protocol domain takeover (April 2026; see cow-swap-dns-hijack-apr-2026), which the report links to the Inferno ecosystem, costs users about $1.2M over about 4.5 hours.",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "incidentTitle": "notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-10",
   "title": "Moonlock publishes its analysis of notnullOSX, including the module that swaps hardware-wallet apps for trojanized copies.",
   "sourceUrl": "https://moonlock.com/new-mac-stealer-notnullosx",
   "url": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026"
  },
  {
   "incident": "litellm-pypi-teampcp-credential-wallet-stealer-mar-2026",
   "incidentTitle": "Compromised LiteLLM releases on PyPI steal cloud keys and crypto wallet data from AI developers",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-24",
   "title": "Malicious LiteLLM 1.82.7 and 1.82.8 were published to PyPI with a credential and wallet stealer, and were later removed.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/popular-litellm-pypi-package-compromised-in-teampcp-supply-chain-attack/",
   "url": "https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-03-01",
   "title": "AngelFerno announces it has acquired Purple Drainer (month reported; day not given).",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "arkanix-stealer-llm-assisted-crypto-wallets-feb-2026",
   "incidentTitle": "Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down",
   "severity": "low",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-02-24",
   "title": "Security Affairs reported Kaspersky's analysis of Arkanix and the project's shutdown.",
   "sourceUrl": "https://securityaffairs.com/188431/malware/arkanix-stealer-ai-assisted-info-stealer-shuts-down-after-brief-campaign.html",
   "url": "https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026"
  },
  {
   "incident": "unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "incidentTitle": "North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-02-09",
   "title": "Mandiant published its analysis, naming seven malware families including WAVESHAPER, HYPERCALL and SUGARLOADER.",
   "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering",
   "url": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026"
  },
  {
   "incident": "openclaw-clawhub-malicious-skills-solana-phantom-feb-2026",
   "incidentTitle": "Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys",
   "severity": "high",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-02-05",
   "title": "Bitdefender Labs published its analysis of malicious OpenClaw skills, including Solana- and Phantom-themed lures that delivered the AMOS stealer.",
   "sourceUrl": "https://www.bitdefender.com/en-au/blog/labs/helpful-skills-or-hidden-payloads-bitdefender-labs-dives-deep-into-the-openclaw-malicious-skill-trap",
   "url": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026"
  },
  {
   "incident": "konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "incidentTitle": "North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-22",
   "title": "Check Point Research published its findings on KONNI's AI-generated backdoor aimed at blockchain developers.",
   "sourceUrl": "https://blog.checkpoint.com/research/ai-powered-north-korean-konni-malware-targets-developers/",
   "url": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026"
  },
  {
   "incident": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "incidentTitle": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-21",
   "title": "SlowMist's CISO warns that Snap Store publisher accounts tied to expired domains are being taken over to ship fake wallet apps.",
   "sourceUrl": "https://cointelegraph.com/news/slowmist-linux-snap-store-crypto-seed-attack",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026"
  },
  {
   "incident": "eip-7702-usenix-study-malicious-delegations-aug-2026",
   "incidentTitle": "USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts",
   "severity": "low",
   "status": "live",
   "threatStatus": "active",
   "date": "2025-12-13",
   "title": "A separate arXiv paper on EIP-7702 phishing reports that authorizations are dominated by a few contract families linked to criminal activity.",
   "sourceUrl": "https://arxiv.org/abs/2512.12174v1",
   "url": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026"
  },
  {
   "incident": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "incidentTitle": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-10-28",
   "title": "Kaspersky disclosed the GhostCall and GhostHire campaigns and their targets.",
   "sourceUrl": "https://www.kaspersky.co.uk/about/press-releases/kaspersky-bluenoroff-targets-executives-on-windows-and-macos-using-ai-driven-tools",
   "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-09-06",
   "title": "BleepingComputer reported Wiz's tally of 2,180 exposed accounts and 7,200 repositories across three phases.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack/",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-09-03",
   "title": "Wiz published its analysis: over 1,700 users had secrets leaked, over 6,700 private repos were exposed, and no successful crypto exfiltration had been seen.",
   "sourceUrl": "https://www.wiz.io/blog/s1ngularitys-aftermath",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-08-26",
   "title": "News broke that malicious Nx versions on npm were stealing tokens and using local AI CLIs to search for wallet and secret files.",
   "sourceUrl": "https://www.wiz.io/blog/s1ngularitys-aftermath",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-08-26",
   "title": "Malicious Nx versions with a data-stealing postinstall script were published to npm.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack/",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-08-20",
   "title": "Proofpoint published its research on Lovable abuse; Lovable said it had removed a phishing cluster and added real-time detection.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  },
  {
   "incident": "cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "incidentTitle": "Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-07-10",
   "title": "Kaspersky disclosed that a fake Solidity extension aimed at Cursor users led to about $500,000 in stolen crypto from a blockchain developer.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-500k-crypto-heist-through-malicious-packages-targeting-cursor-developers",
   "url": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025"
  },
  {
   "incident": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "incidentTitle": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-06-18",
   "title": "Huntress published its analysis, attributing the attack to BlueNoroff (TA444).",
   "sourceUrl": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-06-17",
   "title": "Proofpoint first saw the Aave-themed lure, a Lovable app linked from SendGrid emails.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  },
  {
   "incident": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "incidentTitle": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-06-11",
   "title": "Huntress was contacted about the intrusion on the employee's Mac.",
   "sourceUrl": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025"
  },
  {
   "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-05-14",
   "title": "CryptoSlate reported the warning and his advice to sign wallet transactions only from a separate, dedicated laptop.",
   "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025"
  },
  {
   "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-05-13",
   "title": "Nailwal warned on X that a hijacked Polygon Ventures Telegram account was sending founders to deepfake Zoom calls.",
   "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025"
  }
 ]
}