{"ok":true,"trend":{"id":620906,"platform":"mastodon","region":"global","key":"💸 $100k in crypto drained. 350+ victims. the withdrawal confirmation email rewritten in their webmail so nothing looks w","title":"💸 $100K in crypto drained. 350+ victims. The withdrawal confirmation email rewritten in their webmail so nothing looks w","url":"https://infosec.exchange/@ppasseri/117366054166105081","first_seen":"2026-10-01T14:54:12.955609Z","last_seen":"2026-10-01T14:54:12.955609Z","last_rank":7,"peak_rank":7,"last_volume":2,"peak_volume":2,"seen_count":1,"score":0.9371875,"category_hint":"cybersecurity","section":"technology","category":"cybersecurity","summary":"A malware strain called Underground is being linked to the theft of roughly $100,000 in cryptocurrency from more than 350 victims. The malware launches a victim's own signed-in Chrome or Edge browser, fakes a Binance two-factor authentication prompt to capture codes, and drains accounts. It also edits the withdrawal confirmation email inside the victim's webmail so nothing looks wrong, and uses a clipboard clipper to swap wallet addresses during transactions.","why":"The sophisticated anti-detection trick of rewriting confirmation emails in webmail makes this info stealer notably dangerous to crypto holders.","tone":"negative","entities":["Underground malware","Binance","Chrome","Edge"],"summarized_at":"2026-10-01T14:55:22.083825Z","meta":{"tag":"infosec","via":"scan","kind":"status","lang":"en","instance":"mastodon.social","tag_uses":1451},"nw":null,"promo":null,"kind":null,"importance":null,"hidden":false,"hide_reason":null,"judged_at":null,"title_en":"Info stealer drains $100K in crypto from 350+ victims","section_name":"Technology","category_name":"Cybersecurity","timeline":[{"captured_at":"2026-10-01T14:54:12.955609Z","rank":7,"volume":2}],"posts":[{"platform":"mastodon","url":"https://infosec.exchange/@ppasseri/117366054166105081","author":"ppasseri@infosec.exchange","title":null,"snippet":"💸 $100K in crypto drained. 350+ victims. The withdrawal confirmation email rewritten in their webmail so nothing looks wrong. 🕵️ \"Underground\" launches your own signed-in Chrome/Edge, fakes a Binance 2FA prompt, and empties the account. A clipboard clipper swaps wallet…","posted_at":"2026-10-01T14:11:03Z","likes":2}],"elsewhere":[],"window":"7d"}}