Meme coin traders have recently fallen victim to phishing attacks disguised as Cloudflare verification screens, resulting in significant financial losses. One trader reported a staggering loss of approximately $600,000 after unknowingly running a malicious script on their computer.
According to market reports on Sept. 16, several popular meme coin pages have been redirecting visitors to fake verification screens. These screens prompt users to execute commands on their computers, allowing malicious scripts to run and potentially steal crypto assets. The attack method differs from typical wallet-draining attacks that involve users approving malicious blockchain transactions, as this phishing page aims to get victims to execute code directly on their computers.
The malicious links are embedded in website fields associated with meme coins. Traders often open these links while researching newly launched tokens, only to be led to a fake Cloudflare verification page. Once users follow the instructions on the page, a malicious script is downloaded and executed on their computers.
This latest campaign is part of a growing trend where phishing attacks use trusted-looking pages to deceive crypto users. In a previous incident, a Hyperliquid trader lost $550,000 after clicking on a sponsored Google advertisement that led to a counterfeit version of a decentralized trading platform. These attacks often involve copying familiar websites, brands, or online services to trick users into interacting with malicious software.
Phishing attacks in the crypto space have increasingly incorporated malware to collect wallet information and credentials from computers. In one instance, a fake Claude desktop application distributed RevStealer malware capable of targeting over 50 cryptocurrency wallets. Another campaign targeted cryptocurrency and AI developers using malicious developer packages to collect sensitive data.
Meme coin traders have been particularly vulnerable to these types of attacks due to their reliance on third-party tools, social media recommendations, and unfamiliar project websites. In a previous incident, a Solana decentralized exchange aggregator warned users about a malicious Chrome extension that drained wallets. Another trader lost $6.09 million after clicking a fake Zoom meeting link, resulting in the theft of millions of tokens.
To protect against such attacks, traders are advised to be cautious when encountering supposed Cloudflare verification pages that prompt them to execute commands or scripts. It is crucial to verify the authenticity of any verification prompts and avoid interacting with suspicious websites to prevent financial losses and unauthorized access to crypto assets.