October 14, 2026
"Drag this icon to your bookmarks and click it three times." That's how logged-in accounts get drained
SlowMist analyzed a new phishing wave against users of the trading app fomo. The trick is old, but it looks like an ordinary "I'm not a robot" check.
HOW IT WORKS
- The victim lands on a fake "human verification" page.
- They're asked to find an icon, drag it to the browser's bookmarks bar and click that bookmark three times.
- The bookmark holds malicious JavaScript. Run on an open fomo page where the person is already logged in, it grabs Privy login tokens, browser data and wallet details.
- The account is taken over and the crypto is withdrawn.
According to SlowMist, the stolen funds went through USDC/SOL swaps, splitting across many addresses, cross-chain hops, the Privacy Cash mixer and gambling platforms.
HOW NOT TO FALL FOR IT
- A real "I'm not a robot" check never asks you to drag anything to your bookmarks or click it.
- See that request on a wallet or exchange page? Close the tab.
- Check your bookmarks bar and delete anything you didn't add yourself.
- Turn on two-factor protection. If you already clicked a suspicious bookmark, end all sessions from a trusted device and change your credentials.
🔎 Check an address before you send: https://amlconsensus.com/en
AML