fei

The Slow Fog security team recently disclosed the discovery of a malicious GitHub repository impersonating the "Qwen 3.8 27B local quantitative model." The repository claims that the model file should exceed 16GB, while the actual downloaded content is only about 487KB, containing disguised files, a LuaJIT interpreter, and obfuscated Lua scripts. Slow Fog emphasizes that the official Qwen project has not been compromised.Slow Fog's analysis indicates that after the malicious program runs, it will collect host information, capture the screen, and send it to the attacker's C2 server; when the hard-coded server fails, it will also read backup C2 addresses from contracts on the Polygon chain, allowing the attacker to rotate infrastructure through on-chain transactions.Subsequent payloads can steal browser login information, cookies, history, email, WinSCP, Steam credentials, as well as files and extension data related to cryptocurrency wallets. Slow Fog also found that at least 23 GitHub repositories and 29 similar compressed packages used the same Lua delivery chain.

According to CoinDesk, the Internal Revenue Service (IRS) has issued a warning that a sophisticated email phishing campaign targeting U.S. cryptocurrency holders is spreading. Attackers are impersonating official tax letters to lure users into scanning malicious QR codes to steal cryptocurrency wallet credentials and private keys.It is reported that attackers are sending paper letters impersonating the IRS, creating a sense of urgency under the guise of "tax compliance" and "account verification," and including QR codes in the letters. Once users scan the code, they may be directed to a counterfeit website, leading to the leakage of wallet login information, recovery phrases, or private keys, resulting in the theft of digital assets.The IRS reminds taxpayers that official agencies will not request users to provide cryptocurrency wallet private keys, recovery phrases, or perform similar "wallet verification" operations through unofficial channels. Cryptocurrency holders should be vigilant against any suspicious emails and letters that request scanning QR codes, connecting wallets, or submitting sensitive information.As the number of cryptocurrency asset holders grows, social engineering attacks targeting digital wallets continue to increase, and regulatory and security agencies are strengthening warnings against related fraudulent activities.

According to Bloomberg, AI pioneer Fei-Fei Li stated that the tech industry needs to better explain the value of artificial intelligence to the public and warned that the growing anti-AI sentiment in the United States could pose risks to global AI development. In an interview with Bloomberg, Fei-Fei Li mentioned that tech practitioners need to strengthen communication with the public to showcase the positive impacts that AI technology can bring.She pointed out, "If we do not demonstrate a positive attitude and a positive direction for development, everyone will be affected." The United States has significant influence in the global tech sector, and if the U.S. cannot show a "positive attitude and development path for AI," it will ultimately affect the entire world.

Harmony has released a rollback plan, intending to retain shard 0 block 92,730,034 and shard 1 block 94,978,278, both corresponding to the time of August 11, 2026, 23:25:37 UTC.Validators will use a replacement database, and the new client version will reject the relevant abnormal block hashes, subsequently continuing to produce blocks from the new block height.

According to Cryptopolitan, cybersecurity company Malwarebytes discovered that a user on a cybercrime forum is selling a "scam toolkit" for $500, which can set up a fake $TSLA token presale website with almost no technical background required.The scam process is as follows: after visitors enter an X username, the page displays their real avatar to create the illusion of a "targeted invitation," combined with a countdown and price increase warnings to create a sense of urgency. If victims choose the "15% reward link wallet" option, they will be asked to enter a 12-word recovery phrase, resulting in their wallet being emptied; if they choose to "invest" directly, they must send cryptocurrency assets to an address controlled by the scammers, and then see a fabricated balance on a fake dashboard. The toolkit's control panel allows operators to track victims in real-time, collect recovery phrases, and check wallet balances in advance to decide whether to strike. Malwarebytes discovered this toolkit on May 16, and recently IRS and Ledger users have also encountered similar phishing attacks.

The U.S. Attorney's Office announced that it has filed a civil forfeiture lawsuit to recover 47,461.73111 USDT, stating that this amount comes from a cyber fraud case. The fraudsters deceived victims into depositing funds into cryptocurrency ATMs and then stole the funds.Law enforcement tracked part of the funds to a cryptocurrency wallet and seized it in March 2026. The investigation also confirmed that the funds of four other similar fraud victims can be traced back to the same wallet.

According to exclusive reports from Titanium Media, ByteDance released an internal email on July 30, announcing the integration of the Feishu product team and the Doubao product team to form a new Doubao product team, which will be unified under the leadership of Doubao head Zhao Qi, while Feishu head Xie Xin will report to Zhao Qi. In terms of the GTM system, the Feishu GTM team will integrate with the Volcano Engine team to establish a new ToB GTM organization called the "Creativity Service Platform," which will be responsible for the marketing, sales, and customer service of ByteDance's MaaS and SaaS cloud services, led by Volcano Engine head Tan Dai, with Feishu sales head Lin Chan and Feishu strategy and marketing head Shi Zhijun reporting to Tan Dai.This integration is the largest adjustment to ByteDance's ToB business since it implemented business segmentation in 2021. After the reorganization, Feishu's products and services will remain unchanged, and Feishu will collaborate more deeply with Doubao on productivity scenarios. The Doubao enterprise version, developed with deep involvement from the Feishu product team, has already begun internal testing among some Feishu clients. Feishu currently covers over 10 million enterprise users, and this integration will further enhance the integrated collaborative capabilities of the ToB business.

According to MacRumors, three iOS users have sued Apple in a federal court in California, alleging that after downloading counterfeit Sparrow Wallet applications from the App Store between May and August 2025, they collectively lost approximately $1.8 million in Bitcoin.The lawsuit claims that even when victims reported fraudulent activity, Apple often took little or no action, and other fake Sparrow applications remained in the App Store. Craig Raw, the developer of Sparrow Wallet, publicly criticized Apple's slow response to the multiple counterfeit versions of his app appearing in the App Store, failing to promptly remove the fake apps, and noted that other fake versions still exist.

According to The Defiant, Robinhood has confirmed that CEO Vlad Tenev's X account was hacked and used to promote a counterfeit meme coin called Vladhood on the Robinhood Chain. According to DexScreener data, VLAD recorded over $22 million in trading volume within hours, with a fully diluted valuation of about $2.6 million. The Robinhood Chain block explorer has marked the contract as a scam.On-chain records show that the token issuance address launched via the issuance platform Pons 46 minutes before the false post, and filled Tenev's X homepage as the token's official website, indicating that the token issuance and the hacking were part of the same coordinated operation. The attacker did not withdraw liquidity throughout the process but instead made six calls to Pons's fee collection function, extracting approximately 31.6 ETH and about 72 million VLAD, totaling around $247,000. This is at least the third social media scam related to Robinhood Chain meme coins in three weeks.

The Hong Kong Interbank Clearing Limited (Hong Kong Clearing) announced that it has recently discovered multiple counterfeit websites that lure users into submitting personal information such as ID card numbers, ID card photos, and phone numbers under the guise of "Buyer Online Security Assurance" for so-called "real-name authentication," and use cash rewards as an incentive, allowing users to recharge and withdraw funds through virtual wallets.The Hong Kong Interbank Clearing Limited urges the public to be cautious of suspicious calls, websites, or other communications, and to report to the police as soon as possible if they suspect they have been scammed.

The Enforcement Directorate (ED) of India has submitted a charge sheet to the PMLA special court in Dwarka, New Delhi, formally accusing Chirag Tomar and his accomplices of participating in a cryptocurrency phishing scam worth approximately $20 million. Investigations reveal that the gang executed attacks by hijacking SEO related to a counterfeit "Coinbase Pro" phishing website, luring users to input account information and further deceiving them into providing 2FA verification, thereby remotely transferring the victims' crypto assets. The funds were subsequently split into thousands of wallets and laundered through P2P transactions with local trading platforms. The case is coordinated with U.S. federal law enforcement actions.Previously, Tomar was arrested by the FBI in the U.S. and sentenced to 60 months in prison for conspiracy to commit wire fraud. The Indian ED stated that it has obtained key evidence through international judicial cooperation and has frozen 129 bank accounts related to the case and assets amounting to approximately 645.5 million rupees, with the involved funds and properties undergoing further recovery and forfeiture procedures.

According to The Block, former Ethereum Foundation researcher Dankrad Feist posted on the X platform, proposing the establishment of a new organization aligned with the Ethereum economy to "save" Ethereum. He believes that the Ethereum Foundation currently holds less than 0.1% of ETH, with no staking or fee income flowing in, so the new organization needs to raise at least $1 billion in funding, managed by competent leaders, with part of the funds coming from staking income, and driven by a more responsible board to boost Ethereum's price.Feist left the foundation last year to join Layer 1 network Tempo. He co-created the Danksharding shard design in the Ethereum community to enhance Layer 2 scalability, was appointed as a strategic advisor in areas such as L1 scaling and user experience during the restructuring of the foundation's leadership, and proposed EIP-9698, which would increase the Gas limit by 100 times.

According to an official statement from JPYC Co., Ltd., when searching for "JPYC" in wallets or DEX, counterfeit tokens with similar names, logos, or symbols may appear.The official reminder is to never judge the authenticity of a token solely based on its name or icon. It is essential to strictly verify that the token contract address matches exactly with what is listed in the official FAQ; even a single character difference indicates a different token. Users are also reminded not to perform any operations such as sending, exchanging, authorizing, or signing with unknown tokens.

SlowMist has issued a security warning stating that a high-risk phishing activity targeting TRON wallet users has been discovered. Attackers created a fake Chrome extension for the TronLink wallet, using Unicode bidirectional control characters and Cyrillic homographs to disguise the brand name. After installation, the extension loads a complete phishing page through a remote iframe, forming a "shell-core separation" credential theft chain.The malicious extension name uses homographs for disguise, and its Chrome Store page inherits the high user count and positive reviews of the real extension, lowering the review threshold. There is very little local code, only loading remote pages, making static analysis nearly impossible to detect malicious behavior. The remote phishing page perfectly replicates the official TronLink web wallet interface, stealing mnemonic phrases, private keys, Keystore files, and passwords, and relaying them in real-time via a Telegram Bot.Built-in anti-analysis features disable right-click, developer tools, drag-and-drop, and printing, and redirect based on the geographic and language settings of Russian users to evade detection. SlowMist recommends immediately uninstalling suspicious extensions, clearing local storage, checking for abnormal traffic, and if credentials have been entered, creating a new wallet and transferring assets immediately.

According to CriptoNoticias, after Western Union launched the official stablecoin U.S. Dollar Payment Token (USDPT) on Solana, at least 24 counterfeit USDPT tokens have appeared on the Solana network.DEXTools data shows that some of these counterfeit tokens were created on platforms like Pump.fun and Raydium, with some created just an hour ago, while others were generated as early as 6 months ago. DEXTools data indicates that one of the counterfeit tokens has seen its price increase by about 100% in the past 24 hours. Such counterfeit tokens carry the risk of a "Rug Pull," leading to a rapid drop in token prices, putting investors at risk of losing their entire principal.

According to DL News, a South Korean forgery gang is selling fake official documents to users via Telegram, prioritizing payments in cryptocurrency or digital gift cards. Among them, a counterfeit Yonsei University diploma is priced at about $200, a certificate of enrollment is quoted at about $100, and a fake diploma from overseas universities is priced at about $341.The report points out that the gang also offers forged materials such as driver's licenses, proof of relationship, certificates of no criminal record, and bank loan documents. South Korean police stated that the number of arrests for forgery cases nearly doubled from 2021 to 2023.

According to the threat intelligence released by the SlowMist security team, its threat intelligence system MistEye has received community feedback regarding an active social engineering attack targeting cryptocurrency users.The attackers contact target users under the pretext of project collaboration, luring them to use a counterfeit "Harmony Voice" software (domain: harmony-voice[.]app) for so-called real-time translation, which is actually malware. SlowMist has synchronized the relevant threat intelligence (IOC) to its corporate clients.

In response to the recent attack on the "ListaDAOLiquidStakingVault" contract, ListaDAO officially released a statement clarifying that the attacked contract was not deployed by the official team, but rather was a counterfeit contract created by an unverified third party using a similar name. All official contracts of ListaDAO were not affected by this incident.According to an in-depth analysis by the GoPlus security team, the attack occurred on April 16, 2026, and the root cause was a business logic flaw in the third-party contract. When a token transfer was made, it triggered the Dividend.setShares() function and altered the share accounting within the contract, which in turn affected the reward calculation in the claimReward() function. The attacker exploited this vulnerability to deplete the assets within the contract.GoPlus reminds that since this logical flaw exists in both segments of the contract code mentioned above, any development projects that fork or reuse this code face a high risk of being exploited. It is recommended that relevant developers promptly conduct code inspections and fixes, and implement continuous auditing mechanisms to ensure the security of smart contracts.

According to Finance Feeds, Apple has confirmed that it has removed a fraudulent app impersonating Ledger Live self-custody wallet from the App Store after an on-chain investigation revealed that over 50 victims lost a total of $9.5 million in cryptocurrency within a week.Previously, on-chain detective ZachXBT disclosed that this counterfeit Ledger Live app was available from April 7 to April 13, 2026. The losses involved multiple blockchains, including Bitcoin, Ethereum, Solana, Tron, and Ripple.