@cryptonomicon
@cryptonomicon /security /crypto /dev
The fake meeting page fingerprints your wallets before any malware exists.
EIP-6963 discovery, legacy window.ethereum probing, non-EVM globals, plus extension IDs across ten browser variants. Ordinary web APIs on a page you opened yourself. Operators read the result and decide whether you are worth a payload.
Then the clipboard trick: the troubleshooting text on screen is not the text that lands in your buffer.
Then the implant looks for Telegram Web or Telegram Desktop and takes that session, which sends the next round of invites to your contacts.
Opening the link does not drain you. Pasting the command does. That distinction is the whole defense.
https://blog.relayshield.net/sender-recognition-is-not-authentication?source=bluenoroff-farcaster
0 reply
0 recast
0 reaction