Fake xStocks, Pendle, and other sites bait crypto users with rewards votes

2026-10-03T20:51:45Z•33bba92c09bef4ae18bc9dcf09fc87e1f29ede53a55f895111eae7cab465768e
AI-securityClickFixDarkSwordKothaminePowerShellTailscalecommand-and-controlcrypto-wallet-drainercryptocurrency-scamsdata-breachiOS-exploitationliving-off-the-landmalwarephishingprivacysocial-engineeringthreat-intelligence

What happened

Malwarebytes Labs security feed covering cryptocurrency wallet-draining scams, phishing campaigns, data breaches, AI and privacy risks, mobile exploitation, malware using legitimate tools for command and control, and social-engineering attacks such as ClickFix. The most directly actionable threats include fake crypto reward-vote sites that prompt wallet connections, DarkSword exploitation via a fake iPhone preorder page, Kothamine malware abusing Tailscale tailcat for encrypted command traffic, and fake verification pages directing Windows users to execute PowerShell commands. The feed also###

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
malwarebytes_labs
Record identifier
33bba92c09bef4ae18bc9dcf09fc87e1f29ede53a55f895111eae7cab465768e
Enrichment time
2026-10-03T20:51:45Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.