ChainCatcher message, SlowMist issued a warning stating that the team recently discovered a suspicious tool while assisting users, claiming that their wallets had "risk authorization" and诱导用户粘贴私钥以解决问题. After investigation, the website signature[.]land was confirmed to be a phishing platform and has been marked as a malicious site by the Web3 anti-fraud platform ScamSniffer.The investigation found that the website's UI mimics a legitimate Revoke tool, with risk results being fabricated, and all user inputs are directly sent to abpulimali@gmail.com. The operator Titan uses various deceptive tactics, including impersonating SlowMist employees, using Zachxbt's avatar on Telegram, and commenting under crypto user posts with an X account that has 74,000 followers, falsely claiming that wallets are at risk and directing users to phishing links.

ChainCatcher news, according to Beincrypto, the blockchain security platform Scam Sniffer has disclosed that the notorious phishing organization Inferno Drainer has recently launched a new type of attack utilizing the upcoming EIP-7702 feature in Ethereum, resulting in individual user losses of up to $150,000.EIP-7702 is a proposal in the Ethereum Pectra upgrade that allows external accounts (EOA) to temporarily act as smart contract wallets during transactions. Attackers exploit this by using authorized MetaMask wallets to batch transfer user assets, rather than directly controlling wallet permissions.Yuxian, the founder of Slow Mist Technology, stated that such attacks have evolved from traditional private key theft to utilizing the "execute" command to perform malicious authorizations in the background. Security experts recommend that users regularly check their token authorization status and use tools like Etherscan to identify abnormal delegation behaviors to mitigate potential risks.

ChainCatcher news, GoPlus Security today warned that with the Pectra upgrade, thousands of users enabling EIP-7702 smart accounts have encountered a dangerous phishing scam.Analysis of the contract code revealed that the malicious Delegator address (0x930fcc37d6042c79211ee18a02857cb1fd7f0d0b), once authorized, will automatically redirect ETH from user accounts to the scammer's wallet.Security experts remind users: only authorize the 7702 feature through official wallet applications, never click on "upgrade" options in external links or emails, and always verify the contract source code.

ChainCatcher news, Slow Mist founder Yu Xian stated that the "fake Ledger" scam has reemerged recently, with attackers mailing counterfeit Ledger devices to users, accompanied by fake manuals, guiding them to input the mnemonic phrases from their real Ledger into a fake application, resulting in asset theft. This attack method had cases as early as 2021, and there are also variants that commit fraud by pre-setting mnemonic phrases or tampering with random number generators.Experts remind that although such physical-layer phishing attacks may seem rare, their success rate is not low, and the targets are often high-net-worth users.

ChainCatcher message, Zhao Changpeng released several security tips to prevent phishing attacks:Never disclose your password to anyone claiming to be "customer service." Real customer service representatives will never ask users for their passwords.Do not click on links received in emails; always log into your accounts by manually entering the website URL or using bookmarks. Before entering any password, make sure to triple-check that the website is not a phishing site.Do not use the same password across multiple sites. Use a password manager to set a unique and strong password for each site, and the password manager will not match your passwords on phishing site domains.Use hardware two-factor authentication (2FA) devices like Yubikey, which can prevent most phishing attacks.

ChainCatcher news, Curve releases the latest update on DNS hijacking: the registrar has successfully frozen curve[.]fi (the domain is currently unavailable, phishing attacks have stopped). Users can access the following domain: curve.finance.

ChainCatcher news, according to Scam Sniffer monitoring, a user just lost 3.13 million WBTC due to signing a phishing signature.

ChainCatcher message, Slow Mist Yu Xian posted on platform X that a cryptocurrency user lost assets exceeding $20,000 after clicking on a phishing website automatically recommended by the Chrome browser while accessing the ChangeNOW exchange.The phishing website used Punycode technology to spoof the domain name (the letter "e" has an anomaly), leading the user to mistakenly believe it was legitimate.

ChainCatcher message, according to a warning from SlowMist founder @evilcos, there have been recent targeted phishing attacks against important figures in the cryptocurrency space. Attackers are using fake Zoom meeting links, combined with deepfake technology to create realistic video meeting scenarios, to lure targets into downloading malware. Once they successfully control the target's device, attackers may steal cryptocurrency assets or related cloud platform permissions. Users are advised to verify whether the meeting link comes from the official domain (zoom.com or zoom.us) to avoid being deceived.

ChainCatcher message, ScamSniffer released the phishing report for April 2025, with total losses amounting to $5.29 million and the number of victims reaching 7,565. Although the loss amount decreased by about 17% compared to March, the number of victims significantly increased by 26%. The largest attack resulted in a profit of $1.43 million through phishing, followed by address poisoning, which profited $700,000.

ChainCatcher message, according to Scam Sniffer monitoring, a victim lost tokens worth $1.43 million due to multiple signatures on phishing signatures.

ChainCatcher message, Musk posted a meme on the X platform, with the caption "As the old saying goes: If a pretty girl messages you asking about cryptocurrency, block 'him'." ------Poseidon

ChainCatcher news, Slow Mist founder Yu Xian stated on social media that the ENS chief developer was previously targeted by a phishing attack that exploited a vulnerability in Google's infrastructure. The phishing gang deceived users by disguising phishing emails as official Google communications, leading to users being targeted by law enforcement. Although Google has implemented countermeasures, today this phishing gang launched a new round of phishing attacks and will continue to lure users to a "google.com" subdomain, enticing users to disclose their account passwords and immediately add a Passkey.ChainCatcher previously reported that ENS chief developer nick.eth mentioned on social media that he encountered an extremely sophisticated phishing attack that exploited a vulnerability in Google's infrastructure, but Google refused to fix the vulnerability.He indicated that the attack emails appeared very authentic, could be verified through DKIM signatures, and were displayed normally in Gmail, alongside other legitimate security warnings. The attackers utilized Google's "Sites" service to create a trustworthy "support portal" page, as users would see "google.com" in the domain and mistakenly believe it was safe, so users need to remain vigilant.

ChainCatcher news, according to Cointelegraph, Manta Network co-founder Kenny Li revealed a highly sophisticated phishing attack. The attackers used video footage of real team members during a Zoom video call, attempting to lure him into downloading malware.Li stated that the other party's camera was on during the video call and the facial footage was real, but there was no sound. The system prompted him to update Zoom and download a script file, which raised his alert. He believes this attack may have been initiated by the North Korean state-sponsored hacker group Lazarus. After being asked to verify identity via Telegram, the attackers immediately deleted all messages and blocked him.

ChainCatcher news, according to the blockchain security company CertiK, its early warning system detected a phishing attack incident, resulting in a loss of approximately 543,000 USDC stablecoins.

ChainCatcher news, according to The Block, the U.S. Secret Service has launched "Operation Avalanche" to combat phishing scams on the Ethereum network. This operation brought together Canadian securities regulators, multiple Canadian police agencies, cryptocurrency exchanges, and a blockchain analytics company, aiming to locate stolen wallets on the Ethereum blockchain. During this operation, stolen funds amounting to $4.3 million were discovered.

ChainCatcher message, according to official news, the AI blockchain project DIN's official X account (@din_lol_) has been hacked.The information currently posted by the account is not from the official team, and users are advised not to click on any links or engage in related interactions. The DIN team stated that they are actively addressing the incident, and further announcements should be based on official channels.

ChainCatcher news, ENS chief developer nick.eth posted on social media that he encountered an extremely complex phishing attack that exploited a vulnerability in Google's infrastructure, but Google refused to fix the vulnerability.He stated that the attack emails appeared very authentic, could be verified through DKIM signatures, and were displayed normally in Gmail, alongside other legitimate security warnings. The attackers utilized Google's "Sites" service to create a trustworthy "support portal" page, as users would see "google.com" in the domain and mistakenly believe it was safe, urging users to remain cautious.

ChainCatcher news, according to Decrypt, the founder of the phishing-as-a-service (PhaaS) provider LabHost, Zak Coyn, has been sentenced to eight and a half years in prison. According to the UK Crown Prosecution Service, the 24-year-old gained $230,000 worth of cryptocurrency by designing and operating the website, which was laundered through multiple wallets and ultimately converted into cash by third parties before being transferred to his bank.It is estimated that thousands of criminals in 91 countries used LabHost to carry out scams, with the total number of victims exceeding one million.Previous news, police from multiple countries jointly cracked down on LabHost's phishing services.

ChainCatcher news, according to Cointelegraph, Emblem Vault's CEO Jake Gallen was hacked after a suspicious Zoom video conference, resulting in a loss of over $100,000 in Bitcoin and Ethereum assets.It is reported that the attacker impersonated a YouTube blogger with over 90,000 subscribers, using Zoom's default remote access feature during a video interview to install malware named "GOOPDATE" on Gallen's computer. The cybersecurity company SEAL stated that the hacker group is known as "ELUSIVE COMET," which typically operates under the identity of Aureon Capital venture capital firm, causing millions of dollars in financial losses.SEAL security researchers recommend that cryptocurrency industry practitioners should promptly disable Zoom's remote access feature to prevent similar attacks.