LaunchOnSF, the team behind the token-launch platform StonkFun, restored its website after detecting a compromise of its frontend by the malicious StepDrainer toolkit. According to security firm Blockaid, at least 12 decentralized finance and token-launch websites were affected, including pickle.finance, echelon.market, origami.finance and fluxbeam.xyz. The attack relied on compromised DNS and domain systems that injected scripts into otherwise legitimate websites. These scripts displayed fraudulent wallet-connection requests designed to harvest token approvals and signatures from visitors, without stealing their private keys. No impact to StonkFun’s smart contracts or significant user fund losses were reported, and teams urged users not to connect wallets and to revoke potentially harmful approvals.
Source: Read the original article
