🚨 SlowMist TI Alert 🚨 The Fearless Wallet browser extension is malicious, with a threat exposure period spanning nearly 20 months, from February 2025 to October 2026. Affected versions include 3.0.1 and 3.0.3–3.0.5, containing malicious code designed to steal wallet recovery phrases, private keys, and keystore files when users unlock their wallets. The stolen data is encrypted using an empty password and exfiltrated through HTTP GET requests to http://tonscanner.org. A remote configuration file allows attackers to enable or disable the malicious behavior. Users who have used the affected extension since February 2025 should consider their wallets compromised. Immediately create new wallets with fresh private keys, transfer remaining assets, review suspicious transactions, and remove the affected extension. Changing passwords or reinstalling the extension is insufficient. Malicious Chrome Extension ID: nhlnehondigmgckngjomcpcefcdplmgc You can also visit https://www.misteye.io/ to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant! https://hackmd.io/@gWEUMERvQZyR5MStsH26g/HyNOm782zg https://enterprise.misteye.io/threat-intelligence/SM-2026-502455