fog

According to Slow Mist's warning, two attackers have been detected replicating the recent Notional Finance vulnerability attack method on the BSC chain. The attackers have completed their preliminary preparations and created malicious fCash positions using the same vulnerability pattern. Currently, the attack has not been fully executed, and the malicious positions are awaiting expiration.Once expired, the attackers may settle the positions and withdraw assets from the protocol. Slow Mist strongly recommends that affected projects take immediate mitigation measures to complete protection before the positions expire.

According to the Slow Fog Security Team, they have detected an attack activity disguised as a free VPS service, specifically targeting iPhone Safari browsers running iOS versions 18.4 to 18.6.2.The attackers exploited six vulnerabilities codenamed DarkSword to form a complete attack chain, covering aspects such as WebKit remote code execution, sandbox escape, and kernel read/write, allowing them to obtain App container files and keychain data without user awareness, and to record keyboard inputs when wallets like imToken, TokenPocket, or TronLink are in the foreground.The Slow Fog team stated that the aforementioned six vulnerabilities have now been patched by Apple, and the current attack belongs to the reuse of n-day vulnerability chains. Simply visiting a malicious page does not directly prove that mnemonic phrases or private keys have been stolen; confirmation still requires device forensics. iOS/iPadOS users are advised to upgrade their systems to version 18.7.3 or 26.3 and above as soon as possible.

Fogo's official announcement states that the Fogo mainnet has been restarted and is operating normally. A total of 400 million FOGO tokens were stolen in this incident, of which 237 million have been recovered and permanently removed from the total supply.The official statement indicates that they are working with centralized exchanges and law enforcement to continue recovering the remaining affected assets. The investigation is still ongoing, and further information will be released through this official channel; please rely solely on updates from this channel.

According to The Defiant, the Fogo mainnet has stopped producing blocks for about 46 hours since Saturday afternoon due to an attack on the Fogo Foundation, resulting in 4 million FOGO tokens (approximately 10.3% of the circulating supply) being transferred to the attacker's address. The foundation initially stated that the chain itself was unaffected, but 15 hours later, the network was actively paused, and plans were made to restrict the related addresses through an upgrade. Currently, the Fogo official explorer shows the last block as 718,525,971, and the RPC endpoint returns a 502 error, while the on-chain TVL tracked by DefiLlama has been frozen at $987,000 for three consecutive days.This downtime is attributed to Fogo's validator design: the chain is managed by a council of 7 voting validators, with the foundation staking evenly among 7 operators, allowing for coordination to pause and implement a client-level address blacklist within minutes. On the exchange side, both KuCoin and Gate have disabled FOGO deposits and withdrawals but retained trading, with a 24-hour spot trading volume of approximately $2.3 million. Meanwhile, a Twitter account impersonating the Fogo Foundation, @FcgoFNDN, posted a false compensation voting link, and Fogo officials reminded users to rely only on information from official channels.Fogo is the second network to actively pause over the weekend, following Cronos, which rolled back its state due to an attack on the Tectonic lending protocol. Fogo raised approximately $7 million by selling 2% of its supply through Binance before launching its mainnet in January, with a valuation of $350 million. The foundation has not yet disclosed details of the attack, compensation plans, or a restart timeline.

According to SlowMist's YuXian monitoring, a certain hacker address is involved in a mass theft incident, affecting over 100 addresses and dozens of real users, due to private key leakage, with hackers profiting approximately $200,000.This gang is an old gang, and the stolen users can try to identify commonalities.

SVM public chain Fogo officially announced that the Fogo mainnet has been temporarily shut down as a precautionary measure due to the detection of unauthorized activity in the past hour.The shutdown aims to prevent further transfer of affected assets. During the downtime, the network will be upgraded to restrict addresses related to the incident. Fogo stated that further updates will be shared after confirming more information and urged users to rely solely on this official channel for updates.

An unknown attacker has breached the Fogo Foundation, transferring approximately 400 million FOGO tokens to a malicious address. The Fogo Foundation has notified major exchanges and is in communication with law enforcement and blockchain forensic experts.This incident will not affect the Fogo blockchain itself, and the network is currently operating normally. The Fogo Foundation will announce further developments once more information is available.

The Slow Fog security team recently disclosed the discovery of a malicious GitHub repository impersonating the "Qwen 3.8 27B local quantitative model." The repository claims that the model file should exceed 16GB, while the actual downloaded content is only about 487KB, containing disguised files, a LuaJIT interpreter, and obfuscated Lua scripts. Slow Fog emphasizes that the official Qwen project has not been compromised.Slow Fog's analysis indicates that after the malicious program runs, it will collect host information, capture the screen, and send it to the attacker's C2 server; when the hard-coded server fails, it will also read backup C2 addresses from contracts on the Polygon chain, allowing the attacker to rotate infrastructure through on-chain transactions.Subsequent payloads can steal browser login information, cookies, history, email, WinSCP, Steam credentials, as well as files and extension data related to cryptocurrency wallets. Slow Fog also found that at least 23 GitHub repositories and 29 similar compressed packages used the same Lua delivery chain.

Arthur Hayes posted on the X platform that the FLOP tokenomics infographic for his AI/crypto project Flop Labs will be released this week. Hayes stated that there will be an AMA on X Spaces and YouTube next week to answer questions about the tokenomics and gather feedback to improve the design.

The founder of Slow Fog, Yu Xian, retweeted a tweet on the X platform regarding the potential poisoning attack risks of Claude Code and published an analysis of the poisoning attack details targeting Grok Build CLI and Claude Code CLI.It pointed out that the security mechanisms of Grok Build CLI are not unified, with different code paths having different trust assumptions, creating gaps that serve as channels for attackers. Attackers may execute arbitrary commands through malicious project configuration files without the user's knowledge, thereby stealing API keys, cloud credentials, or controlling local devices.Researchers constructed a testing environment and found that on Mac systems, if Claude Code is affected, executing specific test commands can trigger the local calculator to launch, proving the existence of potential command execution risks.If the attack is successful, attackers may further steal API keys from AI services like Claude and OpenAI, resulting in account cost losses, gain access to servers and data by obtaining cloud service credentials from AWS, Alibaba Cloud, Tencent Cloud, modify code repositories to implant backdoors, and use local devices as jump points to attack corporate internal networks. It is reported that the related vulnerabilities have existed for a year.

The Chief Information Security Officer of Slow Fog, 23pds, posted on the X platform that curl recently fixed 18 security vulnerabilities, involving issues such as authentication bypass, memory safety, and host verification, among which one libcurl vulnerability has existed for about 25 years. The risks are not limited to the curl command line but also widely affect applications, SDKs, containers, firmware, gateways, and CI/CD environments that rely on libcurl. It is recommended to upgrade curl/libcurl as soon as possible and check for the use of old versions of libcurl, especially paying attention to mTLS, proxy authentication, and connection reuse scenarios.

According to Slow Fog monitoring, Little Boy Plus was attacked, resulting in a loss of approximately 377,642 USDT (about 610.555 BNB). The vulnerability was due to the _update function of the LBPHashrate contract being triggered by a zero-value transferFrom call, bypassing OpenZeppelin's authorization checks. The attacker could call this function without authorization, triggering _harvest and minting LBP tokens to the PancakePair address through LBP.mintReward. The minted LBP increased the pool balance but did not change the reserves, and the attacker subsequently drained USDT through PancakePair.swap.

Slow Fog stated that over 140 Mastra-related npm packages were subjected to a supply chain attack, with the affected versions introducing the malicious dependency easy-day-js@1.11.22, triggering code execution controlled by the attacker during the installation phase.

The founder of Slow Fog, Yu Xian, stated that the attack Asterix encountered is similar to that of Flooring Protocol and BMP yesterday (the underlying protocols are DN404 and BT404), with high-level NFT ID displacement operations overflowing and being reused. It seems the attackers are looking for common vulnerabilities.It is reported that Asterix disclosed an attack incident affecting the ASTX token contract yesterday, stating that its Uniswap v4 liquidity pool was attacked on June 8, with attackers stealing approximately 30 ETH through 242 transactions. The vulnerability originated from a lack of token ID restriction checks on approval operations in an early version of DN404. Attackers exploited the outdated token approval to repeatedly sell tokens in the pool to obtain ETH, and then extracted equivalent tokens through forged IDs, leading to a cycle that drained the funds.Smart contracts are immutable and cannot be patched. The team advises users to stop interacting with the current pool and tokens and is planning to migrate to deploy secure tokens. The team suspects that the attackers used a jailbroken AI tool for fuzz testing to discover unconventional logic paths.

According to Slow Fog monitoring, the DTXT/USDT trading pair on the BNB Chain was attacked, resulting in a loss of approximately 35,041 USDT.The root cause of the attack lies in the DTXT contract, which determines the type of operation by comparing the USDT balance with the trading pair's reserve amount. The attacker directly transferred a small amount of USDT to the trading pair address, causing a large DTXT sell-off to be misjudged as adding liquidity, thus bypassing the sell transaction fee logic.The attacker borrowed 1,077,400 USDT through a flash loan from Moolah, making a profit of approximately 35,000 USDT.

According to SlowMist monitoring, a new type of Rust supply chain malware activity named IronWorm is attacking developer environments and the Web3 ecosystem through malicious npm packages. Potential attack behaviors include credential theft, wallet mnemonic and password theft, GitHub repository tampering, malicious package publishing, CI/CD secret leakage, Tor-based command control, and eBPF rootkit stealth.Security teams should audit the repository for backtracked commits, suspicious branches, unexpected build hooks, and commits from automated identities such as claude, dependabot, renovate, or github-actions. It is recommended to remove or deprecate affected package versions, publish clean versions, rotate all leaked keys and tokens, review GitHub Actions artifacts, and rebuild potentially compromised development or CI systems from clean images.

SlowMist has issued a security alert, detecting an active npm supply chain attack targeting @redhat-cloud-services related packages. Currently, over 31 packages have been confirmed affected, with a weekly download volume of approximately 116,000 times, and stolen credentials exist in more than 300 GitHub repositories. This attack method is highly similar to the previous "Shai-Hulud" npm attack, including credential theft, creation of malicious repositories, and automated secret leakage. New suspicious repositories continue to emerge, indicating that the attack is still ongoing, and developers are still being continuously infected.Potential harms include: theft of GitHub/npm tokens, leakage of AWS/GCP/Azure cloud credentials, collection of SSH keys and Kubernetes secrets, leakage of local environment and wallet data, creation of malicious repositories and persistence operations, and even potentially destructive actions after tokens are revoked. It is recommended to immediately remove or downgrade affected @redhat-cloud-services package versions, conduct a comprehensive audit of CI/CD workflows and dependency installations, rotate all GitHub, npm, cloud service, SSH, and wallet-related keys, retain logs, and rebuild exposed developer machines or Runners from clean images while maintaining a high level of vigilance.

The founder of Slow Fog, Yu Xian, posted on the X platform to interpret the Squid security incident. He stated that sampling found that the related Safe wallets were all single-signature, and the owners were all different, but the issue was not with the private keys; the problem lay in the modules (SquidRouterModule) used by these Safe addresses, which had vulnerabilities. Attackers could forge messages, easily bypass relevant validations, and initiate subsequent exchange operations to transfer funds from the target Safe wallet. In addition, Yu Xian also disclosed information about the address where the attackers' profits were deposited.Previously, it was reported that a third-party Gnosis Safe module was exploited on Base and Ethereum, resulting in a loss of approximately $3.2 million, with the victims being 86 Gnosis Safes that had added this contract as a trusted Safe Module. The contract was named "SquidRouterModule" on Basescan, and subsequently, Squid clarified that it was not affected by the Gnosis Safe-related vulnerability incident.

Slow Fog's Yu Xian posted on the X platform stating that the reason for the Verus theft may be that the attacker constructed a forged Merkle proof, which passed the verification of the Verus Ethereum bridge (not open source), thus successfully withdrawing funds (ETH/tBTC/USDC). Specific details need to be further verified.

The slow fog余弦 social media stated that the high-risk iOS attack framework DarkSword has been publicly leaked on channels such as GitHub and is being used for large-scale espionage attacks targeting cryptocurrency wallet holders.This attack program targets devices running iOS versions 18.4 to 18.7, utilizing vulnerabilities in the Safari browser through malicious web pages to achieve remote code execution, thereby stealing users' sensitive data. Attackers launch attacks using bait web pages that impersonate pornographic live streams, Tron energy stations, refund processes, and more.iPhone users running older versions of iOS, once they access such web pages using the Safari browser (even if they do not close the page), may have sensitive information such as plaintext private keys and mnemonic phrases stolen by malicious JavaScript code when unlocking the wallet app, which is then transmitted in real-time through channels like Telegram bots.