tangemwalletdesktop[.]icu

PhishDestroy identifies tangemwalletdesktop.icu as an active crypto drainer posing as a desktop wallet for Tangem users. This domain was flagged due to its zero detections on VirusTotal (1/95) and active redirection to malicious payloads targeting cryptocurrency holders. The site mimics legitimate wallet software to deceive users into downloading and installing drainer malware, which silently transfers crypto assets to attacker-controlled wallets. This domain exhibits multiple red flags consistent with malicious intent. Registered on May 02, 2026, just days ago, it already hosts a Let’s Encrypt SSL certificate to appear trustworthy. The domain resolves to IP address 216.198.79.65 and is hosted by NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar with a history of enabling fraudulent domains. Critically, it remains undetected on VirusTotal with 1/95 security engines flagging it, indicating it is a newly deployed and rapidly evolving threat. Users who visited tangemwalletdesktop.icu should immediately assume compromise. Do not enter any seed phrases, private keys, or wallet credentials on this site. Disconnect any devices that accessed the domain, scan for malware using up-to-date antivirus tools, and revoke any exposed API keys or wallet permissions. Report the domain to your antivirus provider and consider rotating all crypto wallet addresses and credentials. This campaign is active and evolving—prompt action is required to prevent asset loss.