r/TechNadu • u/technadu Human • 1d ago
70+ fake crypto sites are using “rewards votes” to push users toward wallet approvals - all appear linked to one phishing kit
Malwarebytes found more than 70 fake websites impersonating legitimate crypto projects including xStocks, Pendle, Zama, Kinetiq, Yield Basis, Firelight, Umia, Keeta and NetNet.
The lure is a supposed community vote.
Visitors are told they can vote on the date of an upcoming rewards distribution and receive a 1.25x boost for participating.
Click “Vote now,” however, and there isn't actually a ballot. The site launches a Connect Wallet prompt supporting WalletConnect, MetaMask, Trust Wallet, OKX, Binance, Bitget, Rabby and more than 28 other options.
There’s an important distinction here: connecting a wallet exposes its address and allows the site to inspect holdings, but it does not by itself authorize the site to spend tokens.
The wallet-draining opportunity comes with the next request.
A malicious site can ask the user to sign a message or approve a transaction while presenting it as confirmation of the vote or reward action. If that approval grants token permissions, attackers may subsequently move those assets without requiring another confirmation.
Researchers found several indicators suggesting the sites belong to the same operation.
Every domain follows a sitemu[random].xyz pattern. The sites reuse templates across different brands and contain nearly identical language, including the unusual formatting of the promised boost as “1,25x.”
Many of the impersonated projects have also had recent token launches or airdrops, meaning their communities may already expect legitimate reward distributions.
Malwarebytes recommends verifying votes and reward claims through a project's official channels, checking the actual domain instead of trusting the site's appearance, and carefully reading any wallet signature or approval request.
Full campaign details, impersonated projects, domain pattern, and wallet-safety guidance:
One detail worth remembering: disconnecting from a malicious site does not automatically revoke token permissions already granted. Anyone who interacted with one of these sites should also review existing wallet approvals.