We found 70 websites that impersonate legitimate crypto projects that invite visitors to vote on the date of an upcoming rewards distribution.

The pages copy the look of the real sites closely, and on most of them the offer is small and believable: Cast a vote, and as an active voter you get a 1.25x boost when the rewards are paid out.

However, the vote is fake and clicking the Vote now button opens a wallet connection prompt. It’s the first step toward requests that could trick visitors into authorizing access to their tokens.

The brands being copied include xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller platforms including Umia, Keeta, and NetNet. None of these pages are affiliated with the projects they imitate.

Copies of familiar brands

Each site is a close copy of the project it targets, down to the logo, menus, and colors. The Firelight copy even carries a real announcement about the protocol’s deposit cap, suggesting the pages were copied from the live sites rather than rebuilt from scratch.

Most use the same wording about voting on the rewards date to earn a boost, though a few vary the pitch. The Pendle copy adds fake dates and a countdown to create urgency, the Keeta copy promises points instead of a boost, and the NetNet copy skips the vote and warns that unclaimed tokens will be burned after 48 hours.

Why these brands

The choice of targets does not appear to be random. Several of the impersonated projects have held a token launch, airdrop, or public token sale within the past year. Others run points or rewards programs. Their communities are used to hearing about rewards, claims, and allocations, and are primed to act on them.

Zama ran a public token auction in January, and its token began trading in February. Kinetiq launched its governance token alongside an airdrop to early users in November 2025. Umia’s token auction ran from August 29 to September 2, only weeks ago. Firelight awards points to early depositors, and Pendle launched on Robinhood Chain on September 4.

A message about rewards from one of these projects would not sound strange to someone who follows it. The lure appears designed to appeal to people who already hold the token or have used the protocol, because they’re the ones who might expect a distribution and want a bigger share.

What happens when you click vote

The Vote button does not lead to a ballot. It opens a Connect Wallet window that is the same regardless of which brand the page imitates. It lists WalletConnect, MetaMask, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, and Rabby, along with an option to browse more than 28 others.

This window resembles the connection prompts people see on legitimate crypto sites, which may make the request seem routine.

Connecting a wallet on its own shares the wallet’s address, allowing the site to look up its holdings. At this point, it does not give the site permission to spend your tokens.

The damage typically comes from what the site asks for next. In wallet-draining scams, a page may follow the connection with a request to sign a message or approve a transaction, presented as confirming the action the visitor came to take. A malicious approval or signature can give the attacker permission to move tokens out of the wallet without further confirmation.

Blockchain transactions generally cannot be reversed, so stolen funds are very difficult to recover.

Signs of a single operation

Several details suggest a shared operation or phishing kit. All of the domains listed at the end of this article follow the same pattern: sitemu followed by a string of apparently random characters, on the .xyz top-level domain.

The same templates are reused across several different brands, with the text appearing almost word for word whether the page is dressed up as Zama, Firelight, or Yield Basis—right down to writing the boost as 1,25x, with a comma in place of the decimal point. The wallet connection window behind the Vote button is identical across the brands as well.

Random domain names spare the operator the work of coming up with a convincing lookalike address for each brand, and losing any single site costs them little. They also make the address bar one of the clearest giveaways on these pages.

How to protect your wallet

Check any claimed vote or rewards distribution through the project’s official channels before connecting your wallet. A familiar logo is easy to copy.

• Check the address, not the design. These pages closely copy the real thing, so branding alone cannot establish that they are genuine. If the domain is not the one the project officially uses, close the tab.
• Go to the project directly. If a vote or a reward is genuine, it will be on the project’s official site or announced on its established social accounts. Use a bookmark or type the address yourself rather than following a link from a message, ad, or reply.
• Read what your wallet asks you to sign. Voting should not require you to approve spending of your tokens. If a signature or transaction request mentions approvals, permits, or transfers, reject it. Wallets that preview the outcome of a transaction can help, but do not approve a request you cannot understand.
• Be wary of boosts, bonuses, and deadlines. Promises of extra rewards and warnings that unclaimed tokens will be burned can pressure you to act before checking.
• Keep most of your funds in a separate wallet. Use a wallet with a small balance for unfamiliar sites, and keep long-term holdings in a wallet that you don’t use for those connections.
• If you already connected, disconnect from the site. If you also signed a message or approved a transaction, use your wallet’s approval-management feature or a trusted token approval checker to review and revoke suspicious permissions. Disconnecting alone does not revoke token approvals. If you suspect your recovery phrase or private key was exposed, move remaining funds to a new wallet created with a new recovery phrase.

How Malwarebytes helps

Malwarebytes Browser Guard can block known phishing and scam sites before you interact with them. That is useful in campaigns like this one, where the fake page closely resembles the real thing.

If you receive a link to a rewards vote, claim page, or airdrop and are unsure about it, Malwarebytes Scam Guard can help assess the link before you connect your wallet. Check the offer through the project’s official channels too.

Indicators of compromise

• sitemufl06qs0r4o[.]xyz
• sitemui6m6bbj1bd[.]xyz
• sitemui8go6g99bb[.]xyz
• sitemuicitd4jrtr[.]xyz
• sitemuidkr38kji0[.]xyz
• sitemuidlij5urd0[.]xyz
• sitemuif3pa5k4eh[.]xyz
• sitemuife3h91vjj[.]xyz
• sitemuioeefbyh3i[.]xyz
• sitemuioi7005ekb[.]xyz
• sitemuizkhpdbjnv[.]xyz
• sitemuj1xencnin8[.]xyz
• sitemuj7lzbasipw[.]xyz
• sitemujbcz1nas1x[.]xyz
• sitemujdi54aitrf[.]xyz
• sitemujejvp4tp0x[.]xyz
• sitemujffobdhxgj[.]xyz
• sitemuji07m137aw[.]xyz
• sitemujoqrmsm0et[.]xyz
• sitemujrfn7witew[.]xyz
• sitemujsm7brhwh0[.]xyz
• sitemujtcvh5q9fj[.]xyz
• sitemujtd8ingh2b[.]xyz
• sitemujtdkvy6c7n[.]xyz
• sitemujufht1ntj4[.]xyz
• sitemujufs1975v4[.]xyz
• sitemujug76lkyke[.]xyz
• sitemujumvtmjaf1[.]xyz
• sitemujuncdlpnng[.]xyz
• sitemujuno47vpud[.]xyz
• sitemujunzgjapds[.]xyz
• sitemujw19idqe01[.]xyz
• sitemujw1uspghl1[.]xyz
• sitemujwcvm5ufu8[.]xyz
• sitemujxjlv2lmhh[.]xyz
• sitemuk3jcm1olr8[.]xyz
• sitemuk3jpe1eph7[.]xyz
• sitemuk3z1hh2tvn[.]xyz
• sitemuk3zjrr2ufy[.]xyz
• sitemuk3zu5776gi[.]xyz
• sitemuk6zd201nsw[.]xyz
• sitemuk7f31386dx[.]xyz
• sitemuk7fi1dcrp4[.]xyz
• sitemuk7fvnvihra[.]xyz
• sitemuk7xbyszpzj[.]xyz
• sitemuk7y434m4om[.]xyz
• sitemuk7yi5eqn74[.]xyz
• sitemuk7ys6db9qj[.]xyz
• sitemuk9ayiwadjz[.]xyz
• sitemuk9c4oppeco[.]xyz
• sitemukh5awm67rj[.]xyz
• sitemukpy2hpmpwv[.]xyz
• sitemukrod1am6ez[.]xyz
• sitemukvxv7j5hmv[.]xyz
• sitemukvy7wudsqb[.]xyz
• sitemukww7ivnaji[.]xyz
• sitemukwxih8302f[.]xyz
• sitemul94tcv4l80[.]xyz
• sitemul95f18sowo[.]xyz
• sitemul95pxqgmm8[.]xyz
• sitemulaay8dbm66[.]xyz
• sitemulaucnbmnrd[.]xyz
• sitemulffos1qryn[.]xyz
• sitemuli8pd7qi9z[.]xyz
• sitemulpmt6if530[.]xyz
• sitemulpnff7964j[.]xyz
• sitemulpo7jkntfz[.]xyz
• sitemulr9d1dg77r[.]xyz
• sitemuls00qrsh0k[.]xyz
• sitemulszq4rm2yn[.]xyz

Using an AI chatbot, assistant, or browser to speed up your work is tempting, but doing it without your employer’s knowledge can put sensitive data at risk.

You’re swamped, so you paste a long email thread into a free chatbot and ask for a summary. It works, it saves an hour, and nobody notices. But the thread may contain customer details or confidential plans you’ve just shared with an outside service.

If your employer hasn’t approved that tool or how you’re using it, that’s shadow AI.

The UK’s National Cyber Security Centre (NCSC) defines shadow AI as:

“the use of AI technology which isn’t captured in an organisation’s approved systems and processes.”

A Microsoft study published in 2025 found that 71% of UK employees surveyed said they had used AI tools at work their employer hadn’t approved. Most people aren’t doing this to cause trouble. They want to get their work done faster, and the tools are right there.

Shadow AI isn’t limited to chatbots. It can also be:

• A browser extension that “improves your writing.”
• A meeting-notes bot that joins your calls.
• An AI feature quietly switched on inside an app you already use.
• A small automation you built yourself that sends data to an AI service.

AI features are appearing in search engines, email apps, and phones. Instead of a helpful list of links, Google now tries to answer your question. Microsoft’s Copilot drafts replies to your boss before you’ve had coffee. Your phone summarizes conversations you don’t even remember having. That makes it easy to start using one without checking whether it’s approved for work.

Why it worries IT and security teams

When you enter data into a public AI tool, it leaves your company’s control. The service may keep that data or use it to improve its models, unless specific privacy controls are in place. That can lead to data breaches, lost intellectual property, and regulatory problems.

There is also a security angle. AI assistants and agents—tools that can take actions on your behalf—are complex software and can have serious vulnerabilities. If an attacker exploits one, they may gain access to the data and services the tool has.

IBM’s 2025 Cost of a Data Breach research found that one in five organizations reported a breach linked to shadow AI. Only 37% had policies to manage AI or detect shadow AI. Organizations with a lot of shadow AI paid roughly $670,000 more per breach.

In a survey of our newsletter readers, 90% of respondents said they were worried about AI using their data without consent. Company data deserves the same care as your own.

How to use AI more safely at work

You don’t need to avoid AI altogether. Think carefully about which apps and services you use before you share data. Start by talking to your employer, then follow these steps:

• Ask for an approved tool. Security leaders say the best way to reduce shadow AI is to offer something better and safer, such as an enterprise AI platform with guardrails.
• Use your work account, not a personal one. Work accounts are the ones your IT team can protect and govern.
• Find out what’s off-limits. Customer details, financial data, HR records, source code, and confidential meeting content may be restricted. Ask which kinds of data you may and may not use with AI.
• Check the privacy settings. Look at whether the tool stores your inputs or uses them to train its models.
• Register your use case. Many organizations keep a list of approved AI tools and uses. A quick approval process makes it easier to stay on the right side of the rules.
• Be careful with agents and plug-ins. Tools that connect to your email, files, or calendar should be reviewed by your IT or security team first.
• Speak up. If the approved tools aren’t meeting your needs, say so. The NCSC recommends open conversations about security to help reduce reliance on unapproved tools.

If you manage a team, remember that banning AI outright tends to push the use further out of sight. Find out why people are turning to unapproved tools. Providing useful, approved options and clear rules can help staff work faster while protecting company data.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Every few months, Malwarebytes gets a chance to test its mettle against real-world threats in an independent laboratory setting. And the latest round of results gives us plenty to celebrate.  

Malwarebytes earned a perfect 18 out of 18 and received another Top Product award from AV-TEST. We also achieved Level 1 Certification from MRG Effitas, and we stopped 100% of threats before they could run in the two latest tests from AVLab Cybersecurity Foundation. 

AV-TEST Windows Consumer Security Product Test

With 18 out of 18 points in AV-TEST’s latest Windows Consumer Security Product Test, Malwarebytes nabbed the organization’s Top Product award for the July/August test cycle.

AV-TEST evaluates security products across three key areas: protection against malware, impact on device performance, and the frequency of false positives. Products need at least 17.5 out of 18 points to earn AV-TEST’s Top Product award, and Malwarebytes received full marks across the board.

Since we first began participating in the test in 2018, we’ve secured the Top Product award more than a dozen times.

MRG Effitas Consumer Assessment 

Malwarebytes also received a Level 1 Certification in MRG Effitas’ July 2026 Consumer Assessment & Certification Programme, which tested eight security products against malware, phishing, and false positives.  

The malware test used 300 live, in-the-wild samples, including Trojans, spyware, ransomware, backdoors, malicious scripts, and financial malware. Malwarebytes blocked every one of them, stopping 99% before they had the chance to run, and the remaining 1% after they began behaving maliciously.  

Our product also generated zero false positives across 100 legitimate apps and blocked all five live phishing sites included in the test. 

Malwarebytes was one of just two products to earn Level 1 Certification, the highest level awarded in the assessment. 

AVLab Cybersecurity Foundation Advanced In-the-Wild Malware Test 

Meanwhile, the results from AVLab Cybersecurity Foundation’s Advanced In-the-Wild Malware Test brought more good news: Malwarebytes keeps getting better at stopping threats before they can run. 

As part of the test, AVLab Cybersecurity Foundation uses threats circulating online and delivers them in ways designed to replicate how people encounter attacks in the real world. 

During both the May and July 2026 tests, Malwarebytes stopped 100% of threats before they could run. 

These latest results join a growing list of honors, including a Best of CNET award and ZDNET’s Editor’s Choice award.

Independent testing helps keep us sharp. We’re proud to see our work recognized, and even prouder to keep delivering the top-notch protection our customers have come to rely on. 

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

The US government is alerting millions of people that their personal information was stolen during a breach of the Pentagon’s personnel records at the Defense Manpower Data Center (DMDC).

The DMDC is a central US Department of Defense (DoD) organization that manages personnel records, ID credentials, and benefit entitlements for military and civilian staff, veterans, and their families. It maintains over 60 million records for US military and civilian staff and their family members to help determine benefits and entitlements, such as healthcare and retirement.

Reportedly, cybercriminals had access from October 2025 to July 2026. CNN reports that the Pentagon confirmed the breach affects 2.76 million living individuals, potentially including current and former defense personnel or their dependents, and 294,000 deceased individuals.

A notification shared on Reddit states:

“A small number of unauthorized users accessed files on a server containing unencrypted PII.”

PII means personally identifiable information. The attackers gained access by exploiting a security vulnerability in an unspecified file-sharing system. The Pentagon says it has “no indication” of misuse. It hasn’t explained how it reached that conclusion or what it considers misuse, and it doesn’t rule out future misuse of the exposed information.

The exposed data is said to include Social Security numbers, names, dates of birth, sex, race, and service details. Some records also include contact information and occupational specialty.

Besides the risk that this data could help foreign intelligence services track US personnel, affected people face a lasting risk of identity theft. Birth dates cannot be changed, and Social Security numbers can only be changed in limited circumstances.

Breaches happen every day. Don’t be the last to know.

SEE PLANS

What to do if you’re affected

The Pentagon is offering 12 months of credit monitoring through IDX. If you receive a notification letter, take up the offer and consider a credit freeze with all three major credit bureaus: Equifax, Experian, and TransUnion. A freeze is free and restricts access to your credit report, helping prevent someone from opening new credit accounts in your name.

Other recommendations are:

• Get an IRS Identity Protection PIN to prevent someone else from filing a federal tax return using your Social Security number.
• Be suspicious of unexpected calls, emails, and texts, especially ones that mention your unit, rank, or job. Attackers can use the stolen details to make phishing attempts more convincing.
• Verify requests through official channels you look up yourself, rather than through contact details in the message.
• Use unique passwords and multi-factor authentication on email, banking, and benefits accounts.
• Limit location sharing and review privacy settings on phones and apps, since military leaders have raised concerns about commercial location data being used to target personnel.
• Follow instructions in the breach letter and further official communications and report any suspicious approach to your security officer.

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

Two separate investigations have raised concerns about betting site DraftKings’ marketing to target problem gamblers, including its use of AI. On September 19, the New York Times reported that the company’s machine learning model targeted people who were more likely to respond to betting promotions by gambling and losing more money.

The model crunched data on each customer, including how often they bet, how much they lost, and what their daily account balances were. According to the report, it used this information to send targeted advertising to lure those people back to the site with promotions. DraftKings uses promotions to entice users into betting more. These offers include profit boosts on winnings.

At news nonprofit ProPublica, journalist Jake Pearson made himself an experimental subject. He spent thousands of dollars betting on the DraftKings app in an experiment to see how the company’s marketing would play out. He reported receiving more promotions as his losses mounted.

After he lost nearly $1,800 betting on basketball in a single evening, DraftKings invited him to a VIP tryout. Full membership followed later.

DraftKings would occasionally send automated messages reminding him to bet responsibly, he said. But he found they were no match for the product design pushing him to do more gambling.

DraftKings denied unfair targeting of gambling customers, arguing instead that its promotions reward engagement rather than losses.

The company’s machine learning model, which former insiders say was developed starting in 2023, replaced a cruder system that crunched basic numbers to report on a user’s behavior.

The newer system dug through data on its own, assessing how much individuals would be likely to lose after receiving promotions. It created an “elasticity” score and used it to identify customers likely to lose more in response to offers, the Times said. This would help the company maximize its return on its promotional spending, said former employee Jayden Butts, who helped develop the system. Butts spoke to the Times as part of an investigation that included interviews with over 40 former employees, along with reviews of Slack communications, internal memos, and betting records.

Other employees attempted to get approval for another model at DraftKings. It would analyze gambling activity in a similar way, but with the opposite goal: to flag users whose gambling was getting out of hand and who were at risk of falling into crisis. According to the data scientists interviewed by the Times, the system showed promise at identifying customers who might need help with compulsive gambling, but DraftKings shut the project down after canceling a demo. Later attempts to develop similar systems within the company also failed.

Behavioral ads and gambling harm

Digital rights advocates warn that AI enables companies to process more data faster for digital advertising. The Electronic Frontier Foundation says this:

“supercharges the harms of online behavioral advertising.”

It’s particularly damaging when advertising encourages addictive behaviors such as gambling.

And online betting looks set to expand. Companies including DraftKings are now running online casino games in select jurisdictions, while prediction markets that allow people to trade forecasts on specific events are also flourishing.

The statistics on gambling are alarming. The World Health Organization estimates that 1.2% of the world’s adult population has a gambling disorder, and that people betting at harmful levels generate around 60% of gambling losses. People struggling with gambling might find it difficult enough to stay away from gambling venues, but mobile gambling apps with hard-to-ignore push notifications and emails can increase the temptation.

What users can do

If you gamble, monitor your gambling activity and set limits, avoid chasing losses, give yourself timeouts from gambling, and talk to someone if you’re struggling with compulsive gambling.

In the US, the National Problem Gambling Helpline connects people with support and local resources via phone and online chat. In the UK, GamCare’s National Gambling Helpline provides 24/7 phone support and other resources.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.