News Heat Trend
Project Overview
Legitimate is an on-chain framework designed to keep physical assets in-sync with their digital counterparts. By using NFC and blockchain technology, Legitimate’s ‘Locked NFT Protocol’ securely links physical products (using the LGT Tag) to distinct digital identities on the blockchain. Use cases extend to: authentication and ownership history, tracing products for sustainability and circularity, facilitating exclusive digital content for product owners, collecting information for marketing and analytics and much more.
SlowMist Warns Rust Supply Chain Attack Spans Multiple Legitimate Crates
SlowMist warned that legitimate crates in the Rust ecosystem—[email protected], [email protected], and [email protected]—were targeted in a supply chain attack. A malicious dependency, proc-macro1, was injected into these packages, enabling the download and execution of cross-platform malware during the Cargo build process. The attack poses risks including remote code execution at build time, host information collection, persistence, and browser data gathering.
Fake crypto AML detection websites trick users into connecting wallets and authorizing transactions
Odaily News, Cybersecurity firm Malwarebytes has discovered that multiple fake cryptocurrency anti-money laundering (AML) detection websites are impersonating legitimate services such as AMLBot, tricking users into connecting their wallets and authorizing transactions. Legitimate AML checks only require a wallet's public address—there is no need to connect a wallet, approve permissions, or sign transactions.These websites simulate the service process through fake progress prompts and detection results. One of the sites even asks users to deposit a small amount of funds to pay so-called detection fees, after which it displays a "clean, low-risk" result regardless of whether a real check was completed. Connecting a wallet does not directly lead to asset theft, but it does expose the address and asset information, making it easier for scammers to craft transactions for users to approve.Malwarebytes noted that similar scams use the same design and process, only changing the names and logos. Users who have approved suspicious token permissions should revoke those permissions; users who have entered their mnemonic phrases or private keys should treat their wallets as compromised and transfer assets to a new wallet. (Decrypt)
Related news
SlowMist Warns Rust Supply Chain Attack Spans Multiple Legitimate Crates
SlowMist warned that legitimate crates in the Rust ecosystem—[email protected], [email protected], and [email protected]—were targeted in a supply chain attack. A malicious dependency, proc-macro1, was injected into these packages, enabling the download and execution of cross-platform malware during the Cargo build process. The attack poses risks including remote code execution at build time, host information collection, persistence, and browser data gathering.
Fake crypto AML detection websites trick users into connecting wallets and authorizing transactions
Odaily News, Cybersecurity firm Malwarebytes has discovered that multiple fake cryptocurrency anti-money laundering (AML) detection websites are impersonating legitimate services such as AMLBot, tricking users into connecting their wallets and authorizing transactions. Legitimate AML checks only require a wallet's public address—there is no need to connect a wallet, approve permissions, or sign transactions.These websites simulate the service process through fake progress prompts and detection results. One of the sites even asks users to deposit a small amount of funds to pay so-called detection fees, after which it displays a "clean, low-risk" result regardless of whether a real check was completed. Connecting a wallet does not directly lead to asset theft, but it does expose the address and asset information, making it easier for scammers to craft transactions for users to approve.Malwarebytes noted that similar scams use the same design and process, only changing the names and logos. Users who have approved suspicious token permissions should revoke those permissions; users who have entered their mnemonic phrases or private keys should treat their wallets as compromised and transfer assets to a new wallet. (Decrypt)