Cloaked advertising campaign leads to a fake “Passport recall” and solicits 12 seed words
According to a researcher's account shared by the vendor, malicious advertising leads to an intermediate “link verification” page: it retrieves the current fraudulent site address from a blockchain contract, allowing the operator to change domains at will, and redirects the visitor to a lookalike domain. There, a commercial fingerprinting service assesses the browser, device, IP and behavior: visitors who look like bots, researchers or scanners are sent to the vendor's real website, while others see a fake “Passport recall” asking them to enter 12 seed words or “create a new vault” whose words the attackers already have. The operator has an admin panel for manually banning and redirecting individual visitors.
If you use Passport, do not enter your seed phrase on any website or in any browser, whether for “verification” or a device “recall”; do not follow advertising links, and check firmware and notices only through the vendor's official channel by typing the address manually. A “clean” page during inspection proves nothing: what is shown depends on the visitor. If you have already entered a seed or created a wallet using someone else's words, consider the funds at risk: generate new keys on a trusted, unaffected device, write down and verify the backup, transfer the funds and wait for confirmation, then retire the old wallet.
Source: x.com - sesi_the_man