Researchers found dozens of lookalike websites impersonating real crypto projects and promising a small, believable reward boost if users “vote” on a rewards distribution date. The vote is fake; clicking “Vote now” triggers a wallet connection prompt and can lead to malicious approval/signature requests that let attackers steal tokens.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You see a Pendle or NetNet page saying, “Cast a vote and get a 1.25x rewards boost.” Looks legit, right? But on these 70 fake “rewards vote” sites, that Vote button never leads to a ballot. It pops a standard-looking Connect Wallet window, MetaMask, WalletConnect, Trust Wallet, the same no matter which project they copy. The trap is what comes next: a signature or approval that quietly grants token access, while the page screams “unclaimed tokens will be burned after 48 hours” to rush you. Remember: voting or claiming should not require spending approvals. Your move: if any “vote” or “boost” page on a random .xyz asks your wallet to approve spending, stop and close it, then only check rewards from the project’s official site or app.
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
Attackers abused access to Brevo (an email marketing platform) to send highly convincing phishing emails from legitimate cryptocurrency company domains to newsletter subscribers. The lures claimed urgent security issues (hardware vulnerability or data breach) and pushed victims to click links,…
Researchers found a turnkey scam kit sold on a cybercrime forum that lets criminals quickly stand up a fake crypto “presale” website styled to look like Tesla. The site uses pressure tactics and a fake investment dashboard to trick people into either handing over their wallet recovery phrase or…
A June 2026 financial-sector threat report describes real phishing emails that used business-looking themes (e.g., money transfers, receipts, voicemail) to push victims to malicious links or HTML attachments that mimic login pages. The report also highlights cases where stolen account information…
