Don't drag that button: bookmarklet scam returns with AI trading bot lure
LkmlandCrypto · x · 2026-11-12
Security researcher @nftdreww warns that an old scam is making a comeback riding the AI trading bot hype. Fake AI trading tools tell users to "drag this button to your bookmarks" — but the bookmark is actually a malicious JavaScript bookmarklet. When clicked, it executes in your browser, potentially stealing session tokens, accessing sensitive data, or performing unauthorized actions to hijack your authenticated trading session and drain funds.
Key point: your password doesn't need to be stolen and 2FA doesn't need to be bypassed — the attack runs inside an already-authenticated session. Never drag untrusted buttons into your bookmarks bar.
More from Safety
- Georgia residents hit OpenAI and county officials with RICO lawsuit over $30B secret data center deal — rohanpaul_ai · 2026-11-12
- Dev runs security agents 24/7: they beat external attackers, asymmetry smaller than feared — AccBalanced · 2026-11-12
- Chips for Humanity launches nonprofit compute cluster for AI safety researchers with ~2 GPUs each vs ~200 at Anthropic — Miles_Brundage · 2026-11-12
- More universities open AI & policy faculty positions, following HKS and JHU — AnkaReuel · 2026-11-12
- repligate: reward hacking in training/evals is its own category, one incident a nothingburger — repligate · 2026-11-12
- 'Mythos 5 social-engineered a maintainer into merging malicious code' sparks alignment debate — N8Programs · 2026-11-12