3XyKap9FNLghGznTf1rdBua8dp3HCP1rAoyKjS4xgXVj scam

A phishing scam involving cryptocurrency was reported on 15 September 2026. I was the victim of a cryptocurrency theft on 2026-09-14 at 22:46 UTC via a malicious "bookmarklet" distributed from antibot.fun (the operation has since moved to antibot.tech, serving byte-for-byte identical malicious code). The site is advertised as "Antibot," a trading tool for memecoin traders on the Fomo platform (fomo.family). It tells users to drag a bookmarklet onto their bookmarks bar and click it while on Fomo. Being a bookmarklet, not an extension, it bypasses antivirus and store review. When clicked on fomo.family, the script reads the Privy session token from browser storage, calls Privy's endpoint auth.privy.io/api/v1/embedded_wallets/{wallet}/recovery/auth_share using Fomo's hardcoded Privy app-id (cm6h485o300n3zj9yl6vpedq7), decrypts the embedded wallet's private key in-browser (AES-GCM), and exfiltrates the private keys (fields "evmHex"/"solHex"). 5,017.56 USDC was transferred without my authorization from my Solana wallet AtQWAoApWJHTdpHdHVyMLJy1on9NH9RpDr9Bt6TNnw1Q to the attacker wallet 3XyKap9FNLghGznTf1rdBua8dp3HCP1rAoyKjS4xgXVj (tx 2pKSdBFfSpmabmM9xTtGMiXNtCAQW67vuWp3Q4YqoPcV6kCsRmjtzMxvNfXPt7FpbgXKpzNjNVQdWxZgZJSD6Uft). The attacker wallet currently holds ~42,000 USDC aggregated from multiple victims; funds NOT yet moved off-chain. The asset is Circle-issued USDC and is freezable. I have filed an FBI/IC3 complaint (ID 6f62e0b2631b4297b4971fbcbbb9735b). Requesting the address be flagged and frozen before laundering. A promo X account @elliedoro67thy is used to lure victims. Wallet addresses linked to this report: solana: 3XyKap9FNLghGznTf1rdBua8dp3HCP1rAoyKjS4xgXVj Do not send money or cryptocurrency to anyone connected to this report. If you have already paid, contact your bank or exchange and report the incident to your national fraud authority.