binancesecurity

Think about this scenario:
You ask a question in a public crypto Telegram group. Within seconds, you receive a direct message from someone who appears to be “Binance Support.” The account has an official-looking Binance logo, a professional title, and even a “verified” badge in the profile picture.
📧The message claims your account is facing a temporary restriction and urges you to act quickly.
Everything looks legitimate. But the moment you follow the instructions, your wallet is drained.☠️
This is not a platform breach or a wallet exploit. It is a form of social engineering based on visual spoofing, an increasingly common scam tactic targeting crypto users.
🔍 The “Bio Trap”
On Telegram, scammers often rely on a simple fact: display names and profile bios are not verified identities. Anyone can write:
• “Official Binance Support”
• “Binance Security Team”
They can also add verification emojis, copied logos, and corporate branding to appear authentic.
However, display names, bios, and profile pictures can all be manipulated. ⚠️Users should carefully inspect the actual @username, which is a more reliable identifier.
🧬 The “Blnance” Trick
Sophisticated impersonation groups often use lookalike usernames designed to fool users at a glance.
Examples:
• Real: BINANCE 👉(Capital "I")
• Fake: BlNANCE 👉(Lowercase "L")
This technique is known as a homograph attack, a visual deception method that exploits similar-looking characters to mimic legitimate identities.
⚠️ Important Reminder
Binance staff will never contact users first on Telegram to:
• Request funds
• Ask for passwords or 2FA codes
• Instruct users to transfer assets for “verification”
Any unsolicited request involving urgency, account restrictions, or asset transfers should be treated with extreme caution.
🔐 Final Thoughts
Attackers no longer just hack systems — they impersonate trusted identities convincingly enough to make users lower their guard. Take a moment to verify the username, question the urgency, and confirm through official channels. A few extra seconds of caution can prevent irreversible loss.
Follow us, stay alert, stay SAFU.
#Binancesecurity #Telegram

The 30-Second Summary
Microsoft Threat Intelligence has identified two #NPM安全 packages — forge-jsx and forge-jsxy — distributing an advanced malware capable of draining your crypto wallets, stealing your private keys, and compromising your browser extensions (MetaMask, Phantom, Rabby, and more). If you are a developer or use Node.js tools, read this carefully.
How It Works
The packages impersonate the official Autodesk Forge SDK to appear legitimate. Once installed via npm install , a malicious agent deploys itself outside the node_modules folder, making it persistent even after an npm uninstall . Your stolen data is then exfiltrated to attacker-controlled servers.
Malware Capabilities (Evolving in Real Time)
The malicious developer published 88 versions in 50 days, continuously enhancing functionality:

Credential theft: keylogging, clipboard monitoring, .env file extraction, shell history capture

Screenshots: periodic desktop captures sent to Discord webhooks

Wallet scanning: automatic detection of BIP39 mnemonics, Solana keys, and secp256k1 private keys

Browser extension compromise: extraction of LevelDB databases from 21 Chromium-based browsers (MetaMask, Phantom, Rabby, etc.)

Remote updates: the malware can receive new instructions without reinstallation
What to Do If You Installed One of These Packages
Consider all your information compromised.
First, check immediately whether you installed forge-jsx or forge-jsxy . Then manually remove the persistent agent located in the .forge-jsxy folder under ~/.local/share/cfgmgr/ . Revoke all secrets present in your .env files and shell history. Transfer your funds to newly generated wallets on a clean, secure machine. If you suspect deep compromise, reinstall your system entirely.
Who Is Behind This?
Researchers uncovered a sophisticated infrastructure: a command-and-control server at 204.10.194.247 , a front domain taohunter.ai posing as an AI startup, and realistic NPM identities ( johnceballos0716 , jacksonkaandorp2 ) designed to build trust.
This campaign signals an evolution: attackers now treat malicious packages as long-term software projects, iterating based on stolen data.
Binance Security Best Practices
Do: Verify the provenance of every NPM package (downloads, creation date, GitHub repository). Use hardware wallets (Ledger, Trezor) for significant holdings. Regularly audit your dependencies with npm audit . Separate your development environments from your personal wallets.
Avoid: Installing packages without verifying authenticity. Storing large crypto amounts in browser extensions. Ignoring security alerts from your package manager. Reusing the same keys or credentials across multiple projects.
💡 The #Binancesecurity Take
Supply chain attacks on software are rising sharply. Developer vigilance is the first line of defense. When you install a dependency, you are inviting code into your environment. Always verify who is knocking at your door.
Sources: Microsoft Threat Intelligence, community security analyses.

Active malware campaigns are exploiting the growing popularity of AI tools to target unsuspecting users. These attacks do not primarily rely on software vulnerabilities or platform breaches. Instead, they target a much simpler behavior: searching online for AI tools such as Claude and downloading what appears to be the official installer.
Attackers are leveraging trust in familiar brands and polished interfaces to distribute malware capable of compromising devices, stealing credentials, and targeting crypto-related assets.
How the Attack Works
These campaigns often begin with sponsored search advertisements.
When users search for terms like “download Claude” or “Claude Code install,” malicious ads may appear above legitimate search results. These ads often look convincing and lead users to counterfeit installation pages designed to closely replicate official documentation.
The fake pages often feature:
Official-looking layouts and brandingInstallation instructions tailored to Windows or macOSDownload links or terminal commands presented as standard setup steps
For Windows users, malicious instructions may execute system tools to silently fetch and run malware.
For macOS users, terminal commands may trigger multi-stage payloads to establish persistent access.
In more advanced variants, attackers have also distributed:
Fake GitHub repositories disguised as leaked premium versionsTrojanized installer packages posing as “Pro” releasesMalware that launches the legitimate application afterward to avoid suspicion
Once installed, the malware may steal browser credentials, session cookies, wallet extension data, API keys, and stored secrets.
Why This Matters for Crypto Users
A compromised device is not just a device issue. It can quickly become a wallet security incident.
These campaigns may target:
Browser wallet extensionsDesktop wallet applicationsStored exchange credentialsmacOS Keychain dataCrypto management tools such as hardware wallet software
Because many of these threats establish persistence and may remove traces of execution, users may not realize their system has been compromised until funds or account access are affected.
How to Stay SAFU
Be cautious with sponsored search downloads
Do not download software through promoted search results without verification.Verify the full domain
Official-looking branding does not guarantee authenticity.Use caution with terminal commands
Even if a command appears in documentation, verify that the source is official and trustworthy before executing it.Be skeptical of “premium unlocked” versions
Offers claiming exclusive features or unofficial Pro releases are strong red flags.Act immediately if exposed
If you recently installed software from an ad result or executed suspicious commands, run a full system scan and rotate all credentials tied to that device.
Final Reminder
Modern malware campaigns no longer rely only on obvious fake pages.
They replicate official documentation, trusted branding, and legitimate workflows with remarkable accuracy.
In crypto, one careless download can become a direct path to wallet compromise. Follow us to stay informed and stay safe.
#Binancesecurity #STAYSAFU #CyberSecurity #WalletSecurity

Suspicious AI trading agents are becoming a growing risk in crypto. AI agents don’t just give advice — they can act on your behalf. Once connected to your wallet or exchange account, they may buy, sell, rebalance, or even move funds automatically.
That convenience also creates risk.
In 2026, a growing number of free AI crypto tools appeared across browser extensions, Telegram bots and Discord assistants. They offer portfolio tracking, market alerts, auto-trading, and wallet management. Many ask for wallet connection permissions to “work properly.”
This is where everyday users face the greatest risk: what looks like a helpful tool may actually be malware gaining enough access to monitor, manipulate, or drain your wallet.
Red Flags to watch for:
> It asks you to connect your wallet to “unlock full features,” even for functions like market data, alerts, or portfolio tracking. These features typically do not require permissions that can trade, transfer, or move funds.
> It is free, but there is no clear company, team, business model, or security review behind it. If you cannot tell who built it, who maintains it, or how it operates, proceed with caution.
> It is being promoted heavily in Discord, Telegram, or Reddit threads by anonymous or unverified accounts.
> It asks for broader permissions than the task requires. A price alert bot should not need trading permissions. A portfolio tracker should not need permissions that allow transfers or withdrawals.
> The app is new, has very few reviews, or its reviews appeared in a short period of time. Check when the tool launched and whether its feedback looks organic.
> Sponsored links in search engine results may be malicious, and the AI agent offered through them could contain malware.
Key Takeway:
Read permissions carefully before approving. When any app, AI or otherwise, asks for wallet or account access, review exactly what it is requesting.
Prefer tools from established platforms with transparent teams, credible security practices, and a strong reputation. A slick interface does not mean trustworthy code.
#Binancesecurity