sso-phantom-com-x-auth-me[.]typedream[.]app

This domain, sso-phantom-com-x-auth-me.typedream.app, operates as a Solana crypto drainer specifically designed to impersonate Phantom, a widely used cryptocurrency wallet. The threat involves luring victims into entering their wallet credentials or authorizing malicious transactions, resulting in the unauthorized transfer of digital assets from the victim’s Solana-based wallet. Analysis indicates the domain is part of a broader campaign leveraging fake authentication portals to exploit trust in legitimate wallet services. Evidence supporting this assessment includes detection by 5 out of 95 security vendors on VirusTotal, indicating moderate but concerning recognition of malicious activity. The domain was registered through Typedream, a platform that enables rapid deployment of web pages, and resolves to the IP address 172.67.206.36. Infrastructure analysis reveals the use of Google Cloud Services, Cloudflare, and Node.js, suggesting a technically sophisticated setup designed to evade detection. The domain appears on one security blocklist and was taken offline, though similar threats may persist under different domains. Users who visited this domain or interacted with its content should immediately revoke any active wallet sessions and disconnect connected applications within their Phantom wallet settings. It is critical to audit recent transactions for unauthorized activity and transfer remaining assets to a new, secure wallet. Enabling multi-factor authentication and monitoring for phishing attempts targeting wallet credentials are recommended mitigation steps. If credentials were entered, assume they are compromised and avoid reusing them across any platforms.