Topic
Malicious apps and interfaces that empty wallets after users connect them.
Investigator JP says Tronify.rent took $69,651 from about 80 crypto users in September and that Google Gemini told one victim the site appeared safe. PhishDestroy had already scored the domain a critical 90/100 threat before that money went to the site.
Reality
Malwarebytes found 70 sites cloning Kraken's xStocks, Pendle and other crypto projects to push a fake rewards vote that opens a wallet prompt. The targets, it says, are projects whose users are used to hearing about rewards and allocations.
Reality
Malwarebytes has now documented three different GTA 6 scam payloads since June, so awareness copy written around one lure is describing a page the operators have already rebuilt. The drainer arrives before any click.
Reality
Socket says the operators bought their way onto tens of thousands of machines and delivered the payload in a routine update. Cleanup means rotating passwords and moving crypto to fresh wallets, user by user.
Reality
An extension allowlist pins an ID, and the ID survives a sale. The operators behind Superior bought or seeded trust that users had already granted, then spent it in an automatic update that stripped page CSP on the way through.
Reality
Socket says the sharpest move in this campaign was buying utilities that already had users, then shipping the payload as version two. Install-time review had already run and passed, and the 80,000-user surface came with the purchase.
Reality
Malwarebytes says fake crypto AML screening sites are draining wallets. The defence is unglamorous: a real basic check needs only a public address, so a connect prompt is the tell.
Reality