🇯🇵🇺🇸🇦🇺🇩🇪 On Sep 18, Japan’s NPA and National Cybersecurity Office, the U.S. FBI and DC3, Australia’s ASD/ACSC, and Germany’s BND and BfV jointly released a report on North Korea-linked #WaterPlum#, also known as “Contagious Interview” . SlowMist analyzed the report, examining the links between fake-job phishing, malware attacks, and “Laptop Farm” operations. 📄 Official report: 🔎 What the report reveals • Dec 2025–Jul 2026: 30,000+ computers infected across 100+ countries and regions • Data from 7,000+ crypto wallets stolen; at least JPY 1.7B (~USD 10.71M) flowed into wallets controlled by WaterPlum • Fake technical interviews can be used to deliver malware, steal credentials and wallet data, and enable further intrusion into corporate networks • Japan disclosed its first Laptop Farm seizure and dismantling 👤 For individuals / freelancers Don’t run unfamiliar interview code on machines holding wallets or sensitive work data. If an alert fires, disconnect from the internet first. 🏢 For hiring / outsourcing teams Treat unusually broad résumés, crypto-only payment requests, and refusal to work on-site as security signals worth investigating. 📖 Full analysis:

🚨SlowMist TI Alert🚨 💸 @DoinGudHQ Loss: ~$35k 🔍 Root Cause: In `acceptOffer` (0x5c924960) of Implementation 0x123aafc8d0a07ce1a146e53aa899e77f21a2dde1, after transferring `offer.price` USDC to `msg.sender`, the offer record is never deleted or zeroed — the swap-and-pop logic that `cancelOffer` performs is missing. This is compounded by absent checks: no `offerer != msg.sender` restriction and no `offerAmount > 0` requirement. An `amount=0` input also defeats `_updateListingAfterTransfer` cleanup (`0 > 0` is false), so the same offer can be replayed with identical calldata, paying out the full price each time. 📌 Attacker: 0xb8c717239bcace558c3a8dc471c16e07bf57a1eb (EOA) / 0xe588834aa3161a0720e8f6bf223748d6098a4b76 📌 Victim: 0xe3a161edd679fc5ce2db2316a4b6f7ab33a8ed6a 📌 Vulnerable Contract: 0x123aafc8d0a07ce1a146e53aa899e77f21a2dde1 Impact: Two replayed `acceptOffer` calls drained the contract's entire escrow balance (70,973.871434 USDC outflow in one tx); attacker profited ~35,380 USDC with zero NFT or principal, funded via flash loan. Powered by Tx:

🚨SlowMist TI Alert🚨 Attackers posing as a Web3 company used a remote job interview as a pretext to ask a candidate to deploy and run a project locally: hxxps://bitbucket[.]org/poc_review58/demoroyalcity Disguised as a real estate and crypto investment application, RoyalCity contained obfuscated malicious code in tailwind.config.js. Running or building the project can trigger payloads capable of stealing browser credentials and wallet extension data, exfiltrating local files, monitoring clipboard contents, and enabling remote control. A separate server-side backdoor in errorHandler.js retrieves and executes remote code. This case closely resembles the recruitment-themed GitHub poisoning attack we previously analyzed, sharing the interview lure, execution through Tailwind, and highly similar payloads for data theft and remote access. Our previous analysis ( provides more detail on this attack pattern. 🔍 IOCs Malicious IP: 144[.]172[.]107[.]50 Malicious domain: server-azure-tau[.]vercel[.]app URLs: hxxp://144[.]172[.]107[.]50:8085/upload hxxp://144[.]172[.]107[.]50:8086/upload ws://144[.]172[.]107[.]50:8087 hxxps://server-azure-tau[.]vercel[.]app/api/ipcheck-encrypted/604 Malicious dependency/repository reference: bitbucket:https://bitbucket[.]org/poc_review58/demoroyalcity Malicious files — SHA-256: tailwind.config.js 62a98662f2f84001edd71b68e8fa318140c750ba9af096f5e4c9a0bb5502eb6e errorHandler.js d6705f52757af8bc2708a39647fc8c34dc02ffab7838a1d9c10fd44cfe9a7081 ⚠️ Verify recruiters independently. Review unfamiliar projects before running them, and keep interview tasks isolated from your everyday development environment, wallets, and sensitive credentials. You can also visit to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant! Thanks to @jhh_kh37332 for sharing the lead.

⚠️ Security Alert: FomoPeek v1.1-1.2 A joint investigation by our security team and @SlowMist_Team has found malicious code in FomoPeek App versions 1.1–1.2 that may expose private keys, seed phrases, credentials, and other sensitive data on iOS devices. If you've installed or used these versions: • Stop using FomoPeek immediately • Create a new wallet with new keys on a trusted device where FomoPeek was never installed • Transfer your assets to the new wallet as soon as possible • Update iOS to the latest available version • Check your accounts for suspicious activity If you detect unauthorized activity, contact the relevant platform's official support team and retain the affected device and evidence for investigation. Protect your keys. Stay vigilant.

⚠️ Security Advisory | iPhone Users: Check Whether You’ve Ever Installed the FomoPeek App Binance is aware of a security incident recently disclosed by the community. According to security firms including SlowMist, the third-party app FomoPeek (versions 1.1–1.2) contains malicious code that can exploit iOS system vulnerabilities to gain the highest level of device privileges, potentially accessing sensitive data stored on the device, including private keys, seed phrases, login credentials, chat history, files, and more. Please note that this type of malware targets the device itself. If an attack succeeds, data from all apps on the affected device may be accessed. Please check the following: 1. Are you using an iPhone or iPad running iOS 26.x or earlier? 2. Have you ever installed the FomoPeek app? If both apply to you, we recommend taking the following steps immediately: 1. Delete the FomoPeek app and do not reinstall it. 2. Update your iOS to the latest available version. 3. For self-custody wallet users: On a device that has never had the app installed, create a new wallet and transfer your assets to the new wallet address. 4. If you notice any unusual asset activity, preserve the affected device and relevant evidence, and contact Binance Customer Support for further investigation. We also remind all users: Do not install apps from untrusted sources, and keep your device software up to date.

🚨SlowMist TI Alert: TraderTraitor Resurfaces via Weaponized Terraform Projects🚨 DPRK-aligned threat actor #TraderTraitor# (aka UNC4899, Jade Sleet) — previously behind the April 2026 LayerZero/KelpDAO breach (~$292M stolen) has compromised a new victim: an India-based IT services company with no ties to crypto. ⚠️ Attack chain: 🎯 Fake job interview lures target DevOps/crypto engineers on GitHub 📦 Weaponized .terraform.lock.hcl files point to attacker-controlled Terraform provider domains ⚙️ Running terraform init triggers download & execution of malicious provider modules 💻 Deploys two macOS backdoors (Rust/ARM64): FLATROOF & ROOFDECK — same families used in the LayerZero attack 🔑 Capabilities include: • Credential and sensitive data theft • Shell and command execution • File collection and exfiltration • Cloud and source-control access 📌 This shows TraderTraitor is casting a wider net — even orgs with zero crypto exposure are being targeted, likely for whatever cloud/API access their developers can reach (AWS, GCP, OVH, OpenStack). 🛡️ Recommendations: 👉 Treat unknown Terraform provider registries as suspect — verify against 👉 Flag engineers with cloud/source-control access for enhanced endpoint monitoring. 👉 Be wary of unsolicited coding "interview assignments" and repos from recruiters. 👉 Avoid using personal/corporate dev workstations for external job interviews. 🔎 Source: @LabsSentinel

🚨 SlowMist TI Alert: Muse Zero-Day 🚨 According to a disclosure by @patrickwardle, a zero-day vulnerability in Muse for Mac could allow a local process without special privileges to hijack the AI assistant by modifying an undocumented setting. ⚠️ The flaw can redirect dictated prompts to an attacker-controlled endpoint, potentially enabling: 🎙️ Prompt/audio capture 💉 Prompt injection 🔑 Theft of authentication material 📱 Remote tasking of the user's connected mobile devices Since Muse can access user-authorized data such as messages, emails, and financial information, a successful attack could potentially expose sensitive information accessible to the assistant. 🛡️ Users should avoid installing or running untrusted Muse-related PoCs and monitor for suspicious local activity until mitigations are available. 🔎 One of 0day PoCs:

🚨SlowMist TI Alert🚨 💸 GaslessReservoirEnabler Loss: ~$23k 🔍 Root Cause: GaslessReservoirEnabler’s erc20WithTransfersAndExecute → _executeInternal checked module addresses but did not bind ERC20 transferFrom instructions to an authorized asset owner, allowing arbitrary callers to spend victims’ existing allowances through whitelisted tokens. 📌 Attacker: 0x46f54c1a86575679fc3d29666c1717e9786279aa 📌 Victim: 997 token-holder addresses, including 0x2f785ef4f514f6b785ab93062e05cfcc937fac96 📌 Vulnerable Contract: 0x9b58fdadc16e30fba313e044bf9e88689c3f163e Impact: Existing WETH and ZED balances were transferred from token holders; proceeds were consolidated and deposited into a bridge on Polygon. Powered by Tx:

🚨 Threat Intelligence | PolinRider Poisons Nova, Using On-Chain Transactions as a C2 Manager SlowMist Security Team identified a PolinRider sample in a development branch of the #LaravelNova# extension package visanduma/nova-two-factor, which has 700,000+ cumulative downloads. The malicious code is hidden in tailwind.config.js and executes during frontend builds. Instead of hardcoding C2 addresses, the loader queries #Ethereum# transactions to dynamically resolve delivery server IPs, allowing the operator to switch servers without republishing the package. The final payload is a cross-platform credential stealer targeting: 🔹 Browser accounts, cookies, and credentials 🔹 Crypto wallet data and extension storage 🔹 Password managers 🔹 Git, GitHub CLI, and other developer credentials ⚠️ Developers and CI/build environments using affected versions should inspect composer.lock and tailwind.config.js, review build-time network activity, and treat successfully executed builds as compromised. Rotate exposed credentials and wallet keys from a clean environment. Full analysis👇

🚨SlowMist TI Alert🚨 💸 @Fetch_ai Loss: ~$2M 🔍 Root Cause: TokenConversionManagerV3's conversionIn() leaves single-EOA ECDSA signature as the sole authorization check. It lacks the checkLimits(amount) modifier present in conversionOut(), and does not verify any on-chain burn/lock proof. Using the leaked authorizer private key, the attacker signed a fresh message for their own address, passed the check, and drained the bridge's entire FET balance in one call. 📌 Attacker: 0x1572f2af7696b39c85e3221cde8efb640f86c362 📌 Recipient: 0x2dcc1085fdcf418b421e45e86e4e54637cc21dfe 📌 Victim/Vulnerable Contract: 0xab424a430cc09864fa1277a38193111705adf3a3 Powered by Tx:

🚨 SlowMist TI Alert: FomoPeek App v1.1–1.2 Asset Theft 🚨 We have recently received multiple reports of users having assets stolen. Our investigation found that the affected cases involved private key exposure, and some of the users had previously installed and used @FomoPeek App versions 1.1–1.2. A joint investigation by the @SlowMist_Team and @okx security teams confirmed that the app contains malicious code.⚠️ Besides its normal features, FomoPeek includes two modules that are unrelated to its stated business functions. One of them contains an #iOS# kernel exploitation framework with eight different exploit methods. The framework can automatically choose an attack method based on the device model and iOS version. ‼️Affected iOS versions: iOS 12.0–18.7 and iOS 26.0–26.1.‼️ If the exploit succeeds, the app may escape the iOS sandbox, access and decrypt Keychain data, and read files belonging to other apps on the device. 🔐 This means sensitive data stored on the device, including private keys, seed phrases, login credentials, chat history, and files, may be exposed. The app also connects to hidden servers that are unrelated to its public-facing services and can receive remote commands. Based on plaintext traffic captured during our analysis, the attack functionality is currently enabled and runs automatically at regular intervals. In general, devices running older iOS versions are at higher risk. If you have installed or used FomoPeek versions 1.1–1.2, we recommend that you take action immediately: 1️⃣ Check your accounts and assets for any unusual activity. 2️⃣ On a trusted device where FomoPeek has never been installed, create a new account and generate a new private key and seed phrase. 3️⃣ Move your assets to the new account as soon as possible. 4️⃣ Update your device to the latest available iOS version. 5️⃣ Do not continue using or reinstalling FomoPeek. 6️⃣ If you notice any suspicious asset activity, contact the official support team of the relevant platform and keep the affected device and related evidence for further investigation.

🚨SlowMist TI Alert🚨 💸 @nimiq Loss: ~$50,463 🔍 Root Cause: ERC20PermitHTLCHandler's `execute()` discards all five calldata parameters (including signature & nonce) and performs no EIP-712 signature, nonce, or business pre-check. The only signature/nonce validation lived in its `preRelayedCall()`, but GSN RelayHub calls `preRelayedCall` on the attacker-specified paymaster. So the attacker set himself as paymaster, fully bypassing that check, used 1 MATIC GSN relay registration to pass `onlyRelayHub` and forged `request.from = victim`, causing `openPrivate()` to call `token.transferFrom(victim, handler, full balance)`. Finally, the attacker directly called the `redeem` function to withdraw these funds using the hosted secret they had crafted. 📌 Attacker: 0x2258491525C21f334c5a2dc22CE55e55023FC45D 📌 Victim: 0x24Cb173Ae221AeA93369f34bdcF0Ddb35b436773 📌 Vulnerable Contract: 0x0cFD862bE942846Cebad797d7c1BC6e47714959b, 0xf615bd7eA00C4Cc7F39fAAD0895Db5f40891359f Powered by Tx:

🚨SlowMist TI Alert🚨 💸 @likwid_fi Loss: 74.31 BNB 🔍 Root Cause: LikwidMarginPosition._executeAddCollateralAndBorrow (leverage=0 branch) never assigns delta.pairDelta, so the borrow path leaves pairReserves untouched. getAmountOut(pairReserves,...) returns the same 4.7857 BNB quote on every call — the attacker repeated the margin/borrow cycle 14 times, settling 211.8M TOKEN at the first-trade marginal price with no AMM price impact. 📌 Attacker EOA: 0x90bde1e0bb16b3deeb9d638acf8d01f19fd2f31e 📌 Attack Contract: 0xc63fb27f52ed8d06673c60c3075b2d3bd26cf4aa 📌 Vulnerable Contract: 0x6bec0c1dc4898484b7f094566ddf8bc82ed7abe8 (LikwidMarginPosition) 📌 Victim Contract: 0x065d449ec9d139740343990b7e1cf05fa830e4ba (LikwidVault) Powered by Tx:

🚨SlowMist TI Alert🚨 💸 @flamincome Loss: ~$345.9K 🔍 Root Cause: Share-price inflation caused by unsafe asset accounting and valuation. The Strategy treated a permissionlessly injectable Convex `BaseRewardPool` balance as its own assets and valued the injected USDP/3CRV LP using Curve `get_virtual_price()`, which significantly overstated its value in the depegged pool. The inflated share price was then redeemed against real Aave aUSDT liquidity. 📌 Attacker: 0x83381e7f7232775735169d72d237b858ffc36871 📌 Victim Strategy: 0xb8d6471cA573C92c7096Ab8600347F6a9Fe268a5 📌 Flawed Contract (Impl): 0xff20De3F3F4C7E9518035a968B4A3CEE500a2AFB Powered by Tx:

🚨 SlowMist TI Alert 🚨 @DCENTWALLETS has reported abnormal asset transfers involving its App Wallet. Users should update the DCENT app to the latest version before making any transfers. Stay alert for #phishing# and impersonation attempts. Never share your recovery phrase/private key or send assets to any address for “recovery” or “compensation.” Please refer to DCENT’s official announcement for details and further updates.

🚨 SlowMist TI Alert 🚨 A vulnerability in an experimental feature of #CoreLightning# (CLN) may put user funds at risk. Please check your node immediately! Official @Core_LN announced on September 15 that it is investigating a vulnerability in an experimental feature that may affect user funds. All nodes with experimental features enabled are strongly advised to disable them immediately and wait for a patch. 🔴 High-risk options include: --experimental-dual-fund (dual funding) --experimental-splicing (now enabled by default) --experimental-peer-storage ⚠️ The SlowMist team found that a similar issue had already been fixed in August: a remote peer could specify an arbitrary or even zero fee rate during the channel opening/funding adjustment (splice) protocol. The local node would sign and write it to the database without additional validation, potentially forcing the node to pay abnormal fees and even triggering a crash loop, leaving the node offline for an extended period and unable to respond to on-chain attacks in a timely manner. 🛡️ Node operators should: 1️⃣ Immediately run lightning-cli disableoption or remove all --experimental-* parameters when restarting; 2️⃣ Do not shut down the node completely — use --offline mode to retain on-chain monitoring capabilities and prevent counterparties from force-closing channels while the node is offline, which could result in fund losses; 3️⃣ After the official patch is released, verify the signature (GPG/SHA256) before upgrading. Do not blindly take action based solely on social media posts; 4️⃣ Beware of fake “urgent patch” links shared by impersonated official accounts. 📌 Source:

🚨 SlowMist TI Alert: KREMLIN Malware 🚨 Recently, a Brazilian banking malware operation, #REF9334#, active since at least May 2025, was disclosed. 🔴 The #KREMLIN# malware ecosystem uses multi-stage loaders and malicious browser extensions to steal credentials, session tokens, and sensitive data. ⚠️ Its malicious extensions can be installed in #Chrome# and #Edge# without user approval by bypassing Chromium integrity mechanisms, including Secure Preferences, HMACs, and App-Bound encrypted hashes. ⛓️ The operation also uses #Ethereum# smart contracts as dead-drop resolvers to dynamically update C2 endpoints and payload hosting locations, making the infrastructure harder to disrupt. ⚙️ After registering a network canary (kill switch) domain, analysts observed 1,515 infected hosts checking in, with 98.75% located in Brazil. 🛡️ Security teams should monitor for related malware, browser-extension activity, and infrastructure associated with the campaign. 🔑 Admin: - 0x5C32A09873be70a92fd8bB5A9fED7967dE06BdE6 📜 Smart Contracts: - 0x902EDbFECFF38f285Bf26283fB9cEB3700061873 - 0x64Def0A6099c4DE9C413B108EAae85A3C7457615 - 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b (currently active) 🔎 IOCs: 📌 Source:

🚨SlowMist TI Alert🚨 💸 @Bonfiretoken Loss: ~ $50k 🔍 Root Cause: Access control missing in BonfireSwap router's `transfer`. The function does not check `msg.sender == from` nor verify the caller's allowance on `from`, letting anyone set a victim as `from` and themselves as `to`. The router drains the victim's TOKEN using its pre-approved allowance (victim → router) and forwards funds via same-token pool swap. 📌 Attacker: 0x2b5bf7d9d9dc1eec68f40c6b7a8f197e65f9731a → attack contract 0x28E976Ea7b83553d6D1D45CE81334156A2632127 📌 Victim: 41 TOKEN holders who approved the router (largest: 0xefF2FC4E3145f58F534d68A36Bcd3085Be6a4096, −5289.1 TOKEN) 📌 Vulnerable Contract: 0x17e801e17cefc6334059189c178d4783830e03d3 (BonfireSwap router) Powered by Tx:

🚨SlowMist TI Alert🚨 💸 Unknown Gnosis Safe wallet Loss: ~$7.73M 🔍 Root Cause: In the `multicall(address, bytes[])` function of the Router contract (address `0x4f005592…`), the `_contract` parameter could be set to `address(this)`. Consequently, the `_isAuthorized` function—used for internal permission checks—would unconditionally return true. This allowed the victim Safe module contract to execute attacker-crafted malicious call data via `DelegateCall`, injecting aEthrsETH into an attacker-created liquidity pool equipped with a hook; the assets were subsequently swapped and redeemed for profit. 📌 Attacker: 0x2f7e143e27f2fa26ef3b8ac72698f1d321422f67 📌 Victim: 0x40e93a52f6af9fcd3b476aedadd7feabd9f7aba8 📌 Vulnerable Contract: 0x4f0055926c839d1d960a82cbf84e2ee933958ebc Txs: Powered by

🚨 SlowMist TI Alert: CVE-2026-85706 🚨 🔴 A critical path traversal vulnerability in @gitlab CE/EE (CVSS 10.0) could allow unauthenticated attackers to read arbitrary files from affected GitLab servers via the Repository Commits API. 🛠️ GitLab has released security patches to address this vulnerability. ⚠️ Affected: affected from 18.7 before 19.1.8 affected from 19.2 before 19.2.6 affected from 19.3 before 19.3.2 🚨 Self-managed GitLab users should upgrade to 19.1.8, 19.2.6, or 19.3.2 immediately, and review logs and potentially exposed credentials after patching. 🔐 Stay alert and keep your infrastructure up to date. 🔗