Case period: User report analyzed October 2026. This article is a retrospective review.
What the researcher observed
SlowMist's 8 October 2026 analysis describes a fake human-verification page targeting a Fomo user. It instructed the visitor to add a bookmark and click it while using an authenticated application. The bookmark contained JavaScript designed to collect browser-stored credentials and wallet-related data, rather than simply open another page.
What remains unconfirmed
The researcher distinguishes observed collection code from the eventual mechanism used to move assets. Attempts to enroll an authentication method were also not proof that enrollment succeeded. Those qualifications matter: the report does not establish that every script branch ran or that a private key was directly extracted in the reported case.
The browser-security lesson
A bookmark can execute code when it uses a script URL. Treat a website asking you to drag and run such an item as a request to run software, even if it calls the step a captcha. Avoid following verification instructions that require operating on another logged-in page. If this has happened, preserve the page and bookmark details without executing them again, and use the application's verified support route to address exposed sessions. This is a research summary, not a reproduction by Wallet Beep.
Source and review date
SlowMist — original source. Source published: 2026-10-08. Source checked: 2026-10-23.
This is an original Wallet Beep editorial summary. Consult the linked source for its full context and any later updates.