{
 "tag": "slowmist",
 "name": "Slowmist",
 "group": "Other",
 "incidents": [
  {
   "slug": "fomo-bookmarklet-fake-verification-oct-2026",
   "title": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026",
   "json": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "bookmarklet",
   "product": "Fomo web app users (Privy embedded wallets)",
   "tags": [
    "solana",
    "bookmarklet",
    "fomo",
    "privy",
    "embedded-wallet",
    "session-hijack",
    "fake-captcha",
    "fake-verification",
    "token-page-link",
    "slowmist",
    "privacy-cash"
   ],
   "amountUsd": 48000,
   "victims": 1,
   "startedAt": "2026-10-08",
   "closedAt": null,
   "updatedAt": "2026-10-08T12:00:00Z",
   "summary": "A Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds."
  },
  {
   "slug": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "title": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "json": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "fake-app",
   "product": "Linux users installing wallet apps from the Snap Store",
   "tags": [
    "bitcoin",
    "multi-evm",
    "fake-app",
    "linux",
    "snap-store",
    "snapcraft",
    "exodus",
    "ledger",
    "trust-wallet",
    "slowmist",
    "seed-phrase",
    "expired-domain",
    "account-takeover"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-01-21",
   "closedAt": "2026-01-21",
   "updatedAt": "2026-01-21T12:00:00Z",
   "summary": "SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published."
  },
  {
   "slug": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "title": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026",
   "json": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Aave aEthLBTC holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit",
    "aave",
    "lbtc",
    "atoken",
    "tornado-cash",
    "scam-sniffer",
    "slowmist"
   ],
   "amountUsd": 1080000,
   "victims": 1,
   "startedAt": "2026-01-03",
   "closedAt": "2026-01-03",
   "updatedAt": "2026-01-03T12:00:00Z",
   "summary": "A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders."
  },
  {
   "slug": "solana-owner-permission-phishing-3m-dec-2025",
   "title": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025",
   "json": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "token-owner-swap",
   "product": "Solana wallet user (single victim)",
   "tags": [
    "solana",
    "token-owner-swap",
    "owner-permission",
    "assign",
    "setauthority",
    "simulation-blind-spot",
    "okx-wallet",
    "phantom",
    "slowmist",
    "signature-phishing",
    "account-takeover",
    "misttrack",
    "whale"
   ],
   "amountUsd": 3000000,
   "victims": 1,
   "startedAt": "2025-12-05",
   "closedAt": null,
   "updatedAt": "2026-10-22T20:36:38.517Z",
   "summary": "A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner."
  }
 ],
 "changes": [
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist founder Cos warned on X of bookmark phishing aimed at the Fomo web app, using a fake CAPTCHA and a bookmark clicked two to three times.",
   "sourceUrl": "https://x.com/evilcos/status/2108000520493490578",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist posted a threat-intel alert saying the technique is an old one now being used against Fomo users.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/2108039792219013578",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist published its analysis: about $48,000 lost after a link on the MOONLET token page led to a fake verification page; 45,106.85 USDC went to one attacker address in three transfers.",
   "sourceUrl": "https://slowmist.medium.com/threat-intelligence-analysis-of-a-malicious-bookmark-phishing-attack-targeting-fomo-users-0985bff1ed36",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "fomo-bookmarklet-fake-verification-oct-2026",
   "incidentTitle": "Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-08",
   "title": "SlowMist said MistTrack traced the funds through USDC/SOL swaps, address splitting, cross-chain transfers, Privacy Cash and gambling platforms.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/2108169316025893169",
   "url": "https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026"
  },
  {
   "incident": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
   "incidentTitle": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-21",
   "title": "SlowMist's CISO warns that Snap Store publisher accounts tied to expired domains are being taken over to ship fake wallet apps.",
   "sourceUrl": "https://cointelegraph.com/news/slowmist-linux-snap-store-crypto-seed-attack",
   "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-01-07",
   "title": "OKX Wallet warns the owner-modification phishing technique is spreading on Solana and says it has added warnings; Phantom reportedly added similar alerts.",
   "sourceUrl": "https://coinfomania.com/okx-wallet-warns-of-new-phishing-scam-targeting-solana-users/",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "incidentTitle": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-03",
   "title": "Scam Sniffer reports a victim lost about $1.08M in aEthLBTC after signing a malicious permit; SlowMist's founder says the funds were swapped to ETH and sent to Tornado Cash.",
   "sourceUrl": "https://www.cryptopolitan.com/phishing-victim-loses-1-08m-malicious-permit/",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2025-12-05",
   "title": "SlowMist warns that a Solana phishing signature moved a victim's account Owner permission to an attacker, with over $3M lost.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/1996528328061382860",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2025-12-05",
   "title": "Coinpaper, citing SlowMist, reported a Solana user lost over $3M after a deceptive signature changed the wallet's Owner permission; protocol teams helped recover about $2M in DeFi assets.",
   "sourceUrl": "https://coinpaper.com/12892/solana-user-loses-3-m-as-hidden-wallet-permissions-exploited",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  }
 ]
}