FOMO users: fake CAPTCHA bookmark steals logged-in sessions
Update
SlowMist: bookmark took Privy tokens; funds through Privacy Cash
09 Oct Grok window: SlowMist's fuller write-up says the malicious bookmark collected Privy login tokens, browser storage, and wallet data, with MFA-related logic in the payload.
MistTrack followed proceeds through USDC and SOL swaps, splits, cross-chain hops, Privacy Cash, and gambling sites. Still no published loss total and no confirmed link to the Frogman drain.
08 Oct 2026: SlowMist and Cos warned of phishing pages that pose as a human check and talk users into saving a bookmark that is really code. Clicking it while logged in to FOMO hands the session to the attacker, who can then move assets.
Cos ties the technique to Privy-style embedded-wallet logins and says people have already been hit; SlowMist says a fuller disclosure is coming. No loss total published. Research snapshot from SlowMist / Cos X and Lookonchain.
369 take
Embedded-wallet apps move the secret from the seed to the session. Never add a bookmark or paste a command from a fake verification page.
Prefer short-lived sessions and check FOMO login state after travel wifi.
Sources