slowmist

The same gang has set up over 1,500 fake websites, including fake exchanges and wallets

Last week, we talked about the DarkSword gang, which uses an iOS trojan to steal wallet private keys and Keychain data. Today, SlowMist shared a new development: the same group has set up more than 1,500 fake websites online, and they’re still accessible. This isn’t old news being recycled—it’s the scale they confirmed today.

These fake websites come in all kinds of disguises: fake e-commerce platforms, exchanges, wallets, games, and virtual currency services. SlowMist Chief Information Security Officer 23pds called them out in a post today, saying that fake Binance and OKX sites are among them. MistEye’s count is also over 1,500—not an estimate, but the number of sites already identified.

There are three common ways retail investors get caught out. First, they search for an exchange’s name and find fake sites mixed in with the top results. The pages look almost identical to the real ones, including the login form. Second, they click links sent through communities, text messages, or DMs. The site asks them to log in, then complete a security check—and once they do, their wallet is empty. Third, they download a fake wallet app. The first thing it asks them to do is import their seed phrase. The moment they enter it, they’ve handed over the keys themselves.

Here are three things you can do right now. First, access exchanges and wallets only through bookmarks you’ve saved yourself or official apps. Don’t click search results or links sent by other people. If you need to log in, open your bookmarks manually. Second, if any website or app asks you to enter your seed phrase or private key, close it immediately. Legitimate official services will never ask you for these on a webpage. Third, update your iPhone to the latest version as soon as possible, and don’t store your seed phrase in Notes or Photos. The trojan is after things like your Keychain data and Notes.

Have you ever opened a fake website that looked almost identical to the real one? How did you realize something was wrong?

#钱包安全 #防骗 #DarkSword #SlowMist

—— Web3 Leek Xiaokai

Disclaimer: This article is for sharing security information and educational purposes only and does not constitute investment advice. Cryptocurrency trading is extremely risky. Please make decisions carefully.

SlowMist published an analysis today about two high-severity PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They have a CVSS score of 9.2 out of 10, putting them in the highest severity tier. Almost all PHP versions from 5.4 through 8.5.11 are affected. Official patches are available, and the vulnerabilities have been fixed in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Even more alarming, details leaked ahead of time: Amazon’s threat intelligence team found that attackers had already been actively trying to exploit the vulnerabilities four days before they were publicly disclosed.

What does this have to do with our wallets? SlowMist used its scanning system MistEye to scan 1,488 crypto-related domains and found that 793 had PHP fingerprints—more than half. Many projects’ official websites, airdrop claim pages, backend interfaces, and some custodial wallet services run on PHP. If a hacker uses this vulnerability to take over a project website’s server, they don’t need to touch the on-chain contract at all. They can simply alter the frontend and replace the receiving address. The page still looks familiar, but after you sign, your money is already in someone else’s wallet.

By the way, Trust Wallet, BNB Chain, and PancakeSwap all issued statements today saying that PHP isn’t part of their tech stacks, so they aren’t affected. CZ also posted something today that ties in neatly with the second half of this story: AI doesn’t need to break Bitcoin’s cryptography. The real danger lies in data leaks combined with phishing and social engineering.

So how could ordinary retail users like us get caught out? There are two common ways. First, a project website is quietly altered. You go there to claim an airdrop, stake, or transfer funds. You don’t understand the signature request that pops up in your wallet, so you casually hit confirm—and your money is gone. Second, hackers take advantage of all the news to send fake security update pop-ups or fake customer support messages to phish you. They use the hype to bait you—that’s the kind of thing CZ was talking about.

How do you protect yourself? Here are three things you can do right away. First, before visiting a project’s official website over the next few days, check whether the project has officially stated that it has applied the patch. If it hasn’t, don’t connect your wallet to the site for now. Better to miss out than lose your funds. Second, before every signature, even if you can’t understand the whole thing, at least check whether the receiving address is one you recognize. If the address doesn’t match, stop immediately and close the page. Third, assume that anyone telling you to install a security update, upgrade your system, or “click here to verify” is a scammer. Check through the project’s official announcement channels. If there really is an update, it will be announced there. Keeping large amounts of funds isolated in a hardware wallet is especially worthwhile these days.

Before signing a transaction, do you usually check the signature details, or do you just hit confirm?

#钱包安全 #防钓鱼 #PHP漏洞 #SlowMist

—— web3 retail investor Xiao Kai

Disclaimer: This is a personal share and does not constitute investment advice. The content is for learning and discussion only. Crypto carries risks; please exercise caution when trading.

53.3% of crypto domains may be running vulnerable PHP: A SlowMist report warns that two critical PHP vulnerabilities (CVE-2026-109618/619, CVSS 9.2) threaten Web3 off-chain infrastructure. Attackers need no account or password—specially crafted requests can execute arbitrary code. All PHP versions from 5.4 to 8.5.11 are affected, and Amazon observed real-world exploitation 4 days ago. MistEye scanned 1,488 crypto domains and found exposed PHP fingerprints on 793; attackers could tamper with front ends to trick users into signing malicious transactions. Patches, including PHP 8.5.12, have been released—upgrade immediately. Has the platform you use upgraded? Join the discussion in the comments.

$ETH $SOL $BNB
#Web3安全 #SlowMist #PHP Vulnerability
(Source: KuCoin)
⚠️Risk warning: The above is shared for informational purposes only and does not constitute investment advice. Investing involves risks; please exercise caution.

🚨 PROTECT YOUR $BTC AS BAD ACTORS DEPLOY FAKE HARDWARE UPDATES! 🛡️

The dust barely settled on the recent hardware supply chain breach, and bad actors are already circling the water. SlowMist just flagged sophisticated phishing schemes pushing fraudulent firmware updates designed to drain unguarded treasuries. 🔍

When volatility hits, your operational security is the ultimate line of defense for your $BTC stack. Double-check every domain, ignore unverified update prompts, and keep your cold storage protocols airtight while the market hunts for direction. 💡

Smart money always locks down self-custody before the next liquidity wave hits. 💬 How often do you audit your own security stack between market cycles? 👇

⚠️ Not financial advice. Always manage your risk. 🛡️

🏷️ #BTC #CryptoSecurity #SlowMist #Trading

🛡️ 👁️

🚨 $1.17B Stolen in Q3 2026: The Bitget Hole and the New Security Floor

📊 Alpha Breakdown:
SlowMist tracked $1.17 billion in cryptocurrency hacks during Q3 2026. September alone saw $762 million stolen across 50 incidents. The Bitget exploit accounts for $387.5 million of the total. These losses exceed the entire first half of the year. The data highlights extreme concentration in top 5 attacks....

🔗 Full Breakdown on YourWeb3Guy:
https://www.yourweb3guy.com/news/1-17b-stolen-in-q3-2026-the-bitget-hole-and-the-new-security-floor

#CryptoHacks #Bitget #SlowMist #Security

SlowMist has not yet confirmed whether the Safari attack on iPhone resulted in crypto theft. The analyzed malware exploits vulnerabilities already fixed in iOS 18.4–18.6.2, and it is not known whether it works on iOS 26.5. The company remains silent about possible losses.

#SlowMist #iOS #CryptoSecurity #BinanceSquare

Read more: https://cointelegraph.com/news/no-confirmed-crypto-theft-iphone-safari-attack-slowmist?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound

SlowMist has not confirmed the crypto theft via Safari on iPhone

- SlowMist has not confirmed information about the theft of digital assets through a Safari vulnerability on iPhone.
- The analyzed Safari sample targets iOS 18.4–18.6.2 and exploits vulnerabilities that had already been patched earlier.
- The effectiveness of the attack on iOS 16.5 has not yet been verified.
- The RSS source has not provided any further details yet.

#SlowMist #CryptoNews #BinanceSquare #iPhone #Safari Security

$btc $eth

vlikevn Titanbot

Source: CoinTelegraph

🚨 POISONED APPLE APPS TARGETING CRYPTO WALLETS ON $ETH AND BEYOND! ⚠️

📌 A silent security breach is creeping into everyday iOS applications, where compromised delivery and utility apps are stealthily draining private keys right off your devices. 🔍 SlowMist founder Yu Xian uncovered malicious payloads exploiting unpatched Apple software to compromise wallet security without raising immediate alarms.

💡 Protecting your bags isn't just about stop-losses; cold storage discipline and updating iOS, iPadOS, and macOS to the latest releases is mandatory defense right now. 💬 How often do you audit your mobile app permissions and system updates to keep your keys safe? 👇

⚠️ Not financial advice. Always manage your risk. 🛡️

🏷️ #ETH #CryptoSecurity #SlowMist #Web3

🛡️ 🔒

Misty Fog releases an AI on-chain intelligence tracking tool, TrackAgent, to help secure blockchains. #SlowMist #TrackAgent #Blockchain security

$US
$GTC
$CT
🚨 Bitget hack reveals new details

According to SlowMist, the attackers started infiltrating systems associated with the Bitget wallet on August 31, weeks before the withdrawal of nearly $388 million on September 24.

🔹 Employee credentials and a custom withdrawal tool were used
🔹 The transfer process lasted about 3 hours
🔹 Later, money-laundering activity suspected to be linked to North Korea was detected via CoW Protocol and Chainflip.

💡 The hack once again highlights the importance of protecting employee permissions and internal systems.

#Bitget
#Crypto
#Bitcoin
#Blockchain
#SlowMist

SlowMist tracks the Bitget hack to a zero-day vulnerability on August 31

- SlowMist discovered malicious activity weeks before the Bitget hack
- Related to a zero-day vulnerability, two security products and custom withdrawal tools
- The RSS source has not provided further details about the damage or affected assets

#BinanceSquare #CryptoNews #Bitget #SlowMist #Security

$btc $eth

vlikevn Titanbot

Source: CoinTelegraph

Toxic FomoPeek on iOS related to the theft case involving $580,000 in crypto

- SlowMist said the malicious FomoPeek versions were previously distributed via the Apple App Store.
- The app exploits an iOS vulnerability to escape the sandbox and access sensitive data from other applications.
- FomoPeek is linked to the theft of $580,000 worth of crypto.

#BinanceSquare #CryptoNews #CryptoSecurity #SlowMist

$btc $eth

#vlikevn Titanbot

Source: CoinTelegraph

This week brought a thought-provoking wake-up call for the DeFi crowd: Aztec suffered its second exploit in less than 7 days, totaling a loss of $2.1 million. SlowMist made it clear: deprecated smart contracts can still be exploited, regardless of whether the project claims to have stopped support.

For traders, the lesson here goes beyond just one platform. Old contracts exist forever on the blockchain. If they aren't fully deactivated, they are ticking time bombs that attackers can trigger at any moment.

Personally, I believe this incident emphasizes a vital principle: always check the approval of your wallet and stay alert with projects that have upgraded but haven't cleaned up their old contracts. Security risks don't vanish when a protocol "upgrades" – they just change hiding spots.

Do your due diligence before interacting with any smart contracts. Risk management is paramount.

#Bảomật #DeFi #CryptoSecurity #Aztec #SlowMist

🚨#تعرض Project #SecondFi (formerly known as the Yoroi wallet built within the Cardano financial system) #لاختراق experienced a massive exploit due to a bug in their web-based Wallet-Generation Software. This flaw allowed attackers to access the private keys of the creators and drain users' funds without permission. A huge exploit in Project #كاردانو has drained over 20 million dollars. The SecondFi project in the Cardano ecosystem faced a major breach after a bug in the wallet creation program allowed attackers to liquidate users' funds. Security firm #SlowMist states that the total damage could exceed 20 million dollars, affecting over 129 million ADA$ and other tokens. Users are urged to move their funds immediately to a new wallet.

$ADA

$20M Hack on Cardano: The LowdownWhat Went Down: A major DeFi project, SecondFi, got hit. Reason: A bug in their web wallet code. The hacker gained access to hundreds of addresses.Damage: Over 129 million $ADA (more than $20,000,000) was siphoned off.Security: The blockchain #Cardano itself was NOT compromised. The network is running smoothly.What to Do: If you were using SecondFi — urgently move your assets to new wallets.

$ADA

#Cardano #ADA #CryptoNews #SlowMist

DARKSWORD HACK LEAKED OLD iPHONE USERS AT RISK 🚨
🚨 DARKSWORD ATTACK LEAKED IN THE WILD OLD iPHONES AND SAFARI USERS ARE TARGETED
This is a serious SECURITY WARNING for every crypto holder.
SlowMist's Yu Xian confirmed that the DarkSword attack program has been leaked in the wild and is actively targeting crypto wallets .
Who is at risk:
iPhones running older versions of iOS
Safari browser users
Anyone holding cryptocurrency wallets on affected devices
How the attack works:
Malicious JavaScript exploit code is being embedded in fake websites impersonating:
Adult live-streaming platforms
TRON energy stations
Refund procedures
Vulnerability alerts
The danger: If users of older iPhone models open such websites using Safari and leave them open, while simultaneously unlocking their wallet apps, their plaintext private keys could be stolen .
What you should do NOW:
Update your iPhone to the latest iOS version
Avoid using Safari for crypto-related browsing
Never leave wallet apps unlocked while browsing
Be extremely cautious of suspicious links
👇 Have you updated your iPhone recently? Stay safe out there.
#DarkSword #cryptohacks #SecurityAlert #SlowMist $BTC

$ETH USERS BEWARE: MALICIOUS SOLIDITY EXTENSION HIJACKS WALLETS NOW 🔥

The juannegro.solidity extension on TRAE IDE has been identified as a cross-platform malware delivery system. It uses an Ethereum smart contract for dynamic C2 configuration, allowing attackers to update payloads without reissuing the extension.

Despite removal from Open VSX, it was still available on the TRAE marketplace as of July 18th. Immediate uninstallation and system scan are critical for anyone who installed it. Are you inspecting every plugin extension before install?

Not financial advice. Always manage your risk.

#ETH #SecurityAlert #Malware #CryptoSecurity #SlowMist

🔥

SLOWMIST'S NEW AI TOOL TRACKS STOLEN FUNDS ACROSS 31 CHAINS – $BTC SAFETY PLAY 🔥

Blockchain forensics just got sharper. SlowMist launched TrackAgent – an AI-driven tracker that monitors 31 blockchains in real time, reconstructs complex fund flows, and identifies attacker wallets. The free asset recovery assessment is a big deal for anyone holding significant positions.

As a trader, I value tools that protect capital. This is the kind of infrastructure that gives me more confidence to hold through volatility. Are you running any chain analysis on your own positions?

Not financial advice. Always manage your risk.

#BTC #BlockchainSecurity #AI #CryptoRecovery #SlowMist

🔥