swgtoken[.]xyz

This domain operates as a crypto wallet drainer targeting users of the OKX cryptocurrency exchange platform. Analysis indicates the site is designed to harvest wallet credentials and execute unauthorized transactions, draining digital assets from connected wallets. The infrastructure mimics legitimate OKX authentication flows, including fake login prompts and wallet connection requests, to deceive victims into disclosing sensitive information or approving malicious transactions. Infrastructure analysis reveals the domain was registered on June 08, 2026, through Global Domain Group LLC. As of the latest scan, 18 out of 95 security vendors on VirusTotal flag swgtoken.xyz as malicious, with detections spanning phishing, fraud, and crypto-related threats. The domain appears on three security blocklists, including entries from specialized cryptocurrency security providers, further corroborating its role in active wallet-draining campaigns. Users who visited swgtoken.xyz should immediately disconnect any connected wallets from the site and revoke any suspicious transaction approvals using a blockchain explorer or wallet interface. It is recommended to scan the device for malware, reset wallet passwords, and monitor accounts for unauthorized activity. If credentials or wallet access were provided, affected users should transfer remaining assets to a new, secure wallet and report the incident to the targeted platform’s security team for further mitigation.