Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet
Fomo web app users (Privy embedded wallets)
A Fomo user clicked a project website link on a token page and landed on a phishing site that asked them to drag an icon to the bookmarks bar and click it three times as a 'human verification'. The bookmark ran on the logged-in Fomo page and took the Privy login tokens and wallet data from browser storage, and about $48,000 (mostly USDC) was moved out. The victim never connected a wallet, signed anything or typed a seed phrase, and had no two-factor login enabled. Fomo users who ran any such bookmark should revoke sessions from a trusted device, turn on MFA and move funds.
Why this severity: $48K reported stolen, 1 victims, still active.
- Started
- Oct 8, 2026
- Chains
- Solana
- Method
- Bookmarklet drains
- Reported stolen
- $48K
- Victims
- 1
Indicators · never visit or send to these
- voltage[.]family
- D783JqupQ2FYhkxUfGEd1gaFEoAJDXRX1NEb4aVH2hZ6
What to do now
- Delete the suspicious bookmark.
- From a trusted device, log out of all Fomo sessions and revoke any sessions you can see, then turn on MFA.
- Check the security of the Google or other account you log in with; changing a password may not end existing sessions.
- Move remaining funds to a fresh wallet, and keep the page URL, bookmark and transaction records for investigators.
Stay safe
Am I affected?
You may be affected if you use Fomo on the web and, on any page, dragged an icon or button to your bookmarks bar and clicked it as a 'verification' or CAPTCHA step. Check your bookmarks bar for entries you did not make yourself, such as one named 'Triple click to verify'. Opening the phishing page alone does not run it; clicking the bookmark on a logged-in page does.
What to do now
- Delete the suspicious bookmark.
- From a trusted device, log out of all Fomo sessions and revoke any sessions you can see, then turn on MFA.
- Check the security of the Google or other account you log in with; changing a password may not end existing sessions.
- Move remaining funds to a fresh wallet, and keep the page URL, bookmark and transaction records for investigators.
How to avoid this
- Real human verification never asks you to drag anything to your bookmarks bar or click a bookmark on a wallet or trading page. Stop at once if asked.
- Treat 'website' links on token pages as untrusted; anyone can set them.
- Keep MFA on, and keep only what you are actively trading in an embedded trading wallet.
Timeline 4
SlowMist said MistTrack traced the funds through USDC/SOL swaps, address splitting, cross-chain transfers, Privacy Cash and gambling platforms.
SourceSlowMist published its analysis: about $48,000 lost after a link on the MOONLET token page led to a fake verification page; 45,106.85 USDC went to one attacker address in three transfers.
SourceSlowMist posted a threat-intel alert saying the technique is an old one now being used against Fomo users.
SourceSlowMist founder Cos warned on X of bookmark phishing aimed at the Fomo web app, using a fake CAPTCHA and a bookmark clicked two to three times.
Source
Alerts & on-chain evidence 2
News & write-ups ›3
How this method works
A fake verify bot or support account gets you to save a bookmark and click it on a trading site. The bookmark runs code inside your logged-in session and empties your wallet. Read about bookmarklet drains →
Follow new drains and updates in your feed reader or Telegram RSS bot.