Featuring MetaMask disabling eth_sign by default as the Monkey Drainer phishing group shuts down, a Namecheap/SendGrid breach behind MetaMask-branded phishing emails, a Google Fi SIM-swap hack, and a fake EthDenver site tied to a phishing wallet.
Featuring address poisoning attacks that exploit lookalike wallet addresses, a deep dive on read-only reentrancy as an emerging DeFi attack vector, LavaMoat's new LavaTube object-graph tool, and RATs hidden in fake game downloads.
Featuring the Lazarus Group's new AppleJeus malware in fake crypto apps, a social engineering scam netting 14 Bored Apes worth $1.07 million, LavaMoat's bin confusion mitigation, and a year-end wrap covering PhishFort takedowns and the MobyMask launch.
Featuring LavaMoat's rollout of Snow and global scuttling to the MetaMask Extension, the case for integrating Snow into MetaMask, a Twitter Space on Snaps and self-custody after the FTX collapse, and Google Sites and Telegram trading bot scams.
Endo's import.meta and __dirname implementations for MetaMask's module compatibility, a distributed key generation prototype snap using multi-party computation for MetaMask Flask, and the launch of MetaMask's HackerOne bug bounty program.
Featuring Endo's CommonJS compatibility milestone for MetaMask's npm dependency chain, LavaMoat v6's 'a'a package naming rollout, LavaMoat's path to React Native and MetaMask Mobile, and an iCloud backup advisory for MetaMask vault data.