{
 "tag": "session-hijack",
 "name": "Session Hijack",
 "group": "Other",
 "incidents": [
  {
   "slug": "fomo-bookmarklet-fake-verification-oct-2026",
   "title": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026",
   "json": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "bookmarklet",
   "product": "Fomo web app users (Privy embedded wallets)",
   "tags": [
    "solana",
    "bookmarklet",
    "fomo",
    "privy",
    "embedded-wallet",
    "session-hijack",
    "fake-captcha",
    "fake-verification",
    "token-page-link",
    "slowmist",
    "privacy-cash"
   ],
   "amountUsd": 48000,
   "victims": 1,
   "startedAt": "2026-10-08",
   "closedAt": null,
   "updatedAt": "2026-10-08T12:00:00Z",
   "summary": "A Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds."
  },
  {
   "slug": "bookmarklet-drains-solana-trading-terminals-wave",
   "title": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave",
   "json": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "bookmarklet",
   "product": "Users of web-based Solana memecoin trading apps (reported: Axiom, Fomo)",
   "tags": [
    "solana",
    "bookmarklet",
    "campaign",
    "axiom",
    "fomo",
    "trading-terminal",
    "embedded-wallet",
    "session-hijack",
    "fake-verification",
    "drainer-tooling"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-12-26",
   "closedAt": null,
   "updatedAt": "2026-10-08T12:00:00Z",
   "summary": "Since at least late 2025, scammers have used fake tools and fake 'verification' steps to get Solana memecoin traders to drag a bookmark into their browser and click it on a trading site they are logged in to, where it takes the session or wallet data and the account is drained. Reports cover Axiom traders in December 2025 and a Fomo user who lost about $48,000 in October 2026; SlowMist called it an old method being reused. In September 2026 Socket found theft code in malicious extensions labelled as Axiom bookmarklet tooling and noted that Axiom bookmark drainers circulate publicly. Traders on any web terminal should refuse any bookmark from others, use MFA and keep trading wallets small."
  },
  {
   "slug": "axiom-bookmark-method-drains-dec-2025",
   "title": "'Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K",
   "url": "https://drains.watch/i/axiom-bookmark-method-drains-dec-2025",
   "json": "https://drains.watch/i/axiom-bookmark-method-drains-dec-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "unverified",
   "traction": "X trending topic on 26 Dec 2025 headlined 'Axiom Trade Bookmark Scam Drains Over $200,000 from Wallets' (seen as a search result; the page itself was not readable). Warning post by @insidecalls the same day showed about 43,000 views, 106 likes, 44 replies and 14 reposts when read on 22 Oct 2026. The original post with the $200K claim could not be found or opened.",
   "chains": [
    "solana"
   ],
   "method": "bookmarklet",
   "product": "Axiom trading terminal users",
   "tags": [
    "solana",
    "bookmarklet",
    "axiom",
    "trading-terminal",
    "session-hijack",
    "fake-token-checker",
    "memecoin",
    "social-report"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-12-26",
   "closedAt": "2025-12-26",
   "updatedAt": "2025-12-26T12:00:00Z",
   "summary": "In late December 2025, X users warned that scammers were luring Axiom traders with fake tools such as token checkers and getting them to drag a bookmark into the browser, which ran on the logged-in Axiom page and gave the scammer access to the victim's funds. An X trending summary headlined the scam as draining over $200,000, and one widely viewed warning post said a person the author knew had recently fallen for it and asked Axiom to patch it. No security firm, news outlet or Axiom statement confirming the amount was found. Axiom users should never run a bookmark someone gives them and should move funds if they did."
  }
 ],
 "changes": [
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist founder Cos warned on X of bookmark phishing aimed at the Fomo web app, using a fake CAPTCHA and a bookmark clicked two to three times.",
   "sourceUrl": "https://x.com/evilcos/status/2108000520493490578",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist posted a threat-intel alert saying the technique is an old one now being used against Fomo users.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/2108039792219013578",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist published its analysis: about $48,000 lost after a link on the MOONLET token page led to a fake verification page; 45,106.85 USDC went to one attacker address in three transfers.",
   "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist said MistTrack traced the funds through USDC/SOL swaps, address splitting, cross-chain transfers, Privacy Cash and gambling platforms.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/2108169316025893169",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "bookmarklet-drains-solana-trading-terminals-wave",
   "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist warned of bookmark phishing against Fomo users, calling it an old exploitation method, and published an analysis of a $48,000 loss.",
   "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave"
  },
  {
   "incident": "bookmarklet-drains-solana-trading-terminals-wave",
   "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-09",
   "title": "Socket reported malicious Chrome and Firefox extensions stealing trading-terminal session and wallet data, with code labelled as Axiom bookmarklet tooling.",
   "sourceUrl": "https://socket.dev/blog/chrome-firefox-crypto-data-theft",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave"
  },
  {
   "incident": "bookmarklet-drains-solana-trading-terminals-wave",
   "incidentTitle": "Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2025-12-26",
   "title": "X users warned of the 'Axiom Bookmark Method', with a trending summary claiming over $200,000 drained.",
   "sourceUrl": "https://x.com/insidecalls/status/2004593677138550834",
   "url": "https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave"
  },
  {
   "incident": "axiom-bookmark-method-drains-dec-2025",
   "incidentTitle": "'Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-26",
   "title": "@insidecalls posted a warning video about the 'Axiom Bookmark Method', saying someone they knew had recently fallen for it, and asked Axiom to patch it.",
   "sourceUrl": "https://x.com/insidecalls/status/2004593677138550834",
   "url": "https://drains.watch/i/axiom-bookmark-method-drains-dec-2025"
  },
  {
   "incident": "axiom-bookmark-method-drains-dec-2025",
   "incidentTitle": "'Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-26",
   "title": "An X trending topic summarized posts saying an Axiom bookmark scam had drained over $200,000 from wallets.",
   "sourceUrl": "https://x.com/i/trending/2004611057839378907",
   "url": "https://drains.watch/i/axiom-bookmark-method-drains-dec-2025"
  }
 ]
}