Do Son Researcher Anurag uncovers a WordPress phishing campaign that steals credit cards and 3-D Secure OTPs, exfiltrating data directly via Telegram bots.
Exfiltration
A malicious Chrome extension, Safery: Ethereum Wallet, steals BIP-39 seed phrases by encoding them into synthetic Sui blockchain addresses and broadcasting microtransactions, bypassing HTTP/C2 detection.