Featuring a surge in airdrop scams that exploited fake giveaway hype to phish users, ~2,400 wallets targeted before the Arbitrum airdrop, a Cloudflare Global API key warning for web3 teams, and EthDenver talks on Delegatable and JavaScript realms.
Featuring MetaMask disabling eth_sign by default as the Monkey Drainer phishing group shuts down, a Namecheap/SendGrid breach behind MetaMask-branded phishing emails, a Google Fi SIM-swap hack, and a fake EthDenver site tied to a phishing wallet.
Featuring address poisoning attacks that exploit lookalike wallet addresses, a deep dive on read-only reentrancy as an emerging DeFi attack vector, LavaMoat's new LavaTube object-graph tool, and RATs hidden in fake game downloads.
Featuring the Lazarus Group's new AppleJeus malware in fake crypto apps, a social engineering scam netting 14 Bored Apes worth $1.07 million, LavaMoat's bin confusion mitigation, and a year-end wrap covering PhishFort takedowns and the MobyMask launch.
Featuring LavaMoat's rollout of Snow and global scuttling to the MetaMask Extension, the case for integrating Snow into MetaMask, a Twitter Space on Snaps and self-custody after the FTX collapse, and Google Sites and Telegram trading bot scams.
Featuring the SES v0.17.0 release landing the "quadruple backflip" evaluator refactor, Socket.dev's disclosure of npm bin script confusion attacks, LavaMoat's new global scuttling defense, and two MetaMask security talks at Devcon VI in Bogota.
Featuring a Consensys study on why MetaMask users fall for phishing, a CircleCI impersonation campaign that bypassed GitHub 2FA, and Twitter-promoted Ethereum Merge scam accounts impersonating Vitalik Buterin and the Ethereum Foundation.
Featuring Merge-themed phishing campaigns impersonating trusted entities to trick users into fake ETH 2.0 conversions, a breakdown of crypto honeypot scam mechanics, LavaMoat-style policy enforcement, and HackerOne bounty program metrics.
Featuring LavaMoat's launch of three experimental browser security tools targeting prototype pollution and cross-realm attacks, a fake $UNI airdrop that phished over 73,000 LP addresses, and a YouTube-based MEV frontrunning bot scam.
Featuring the $120,000 clickjacking bounty awarded to the UGWST, the Halborn "Demonic" vulnerability disclosure affecting browser wallets, plus the deprecation of eth_decrypt and eth_getEncryptionPublicKey.