A single phishing attack drained nearly $1 million worth of tokens from a crypto investor who unknowingly signed a batch of malicious transactions disguised as Uniswap swaps, according to blockchain security firm Scam Sniffer.

In an Aug. 22 post on X, Yu Xiang, founder of blockchain security firm SlowMist, noted that the incident involved five tokens siphoned through a transaction exploiting Ethereum’s new EIP-7702 mechanism.

He explained:

“From the perspective of a phished user, it goes like this: the user opens a phishing website, a wallet signature prompt pops up, the user clicks confirm, and with just that one action, all valuable assets in the wallet address vanish in a snap.”

EIP-7702 was introduced in the Pectra upgrade to streamline the Ethereum user experience. The feature allows a wallet to act like a temporary smart contract, making it possible to batch multiple transactions, enable gas sponsorship, or set spending limits in one step.

In principle, the delegation is revocable and network-specific. However, attackers have found ways to weaponize the feature in practice.

Crypto market maker Wintermute has warned that the standard’s implementation is being exploited at scale. Its June analysis showed that more than 90% of EIP-7702 delegations were linked to malicious contracts.

The firm pointed out that many of these contracts are simple copy-paste scripts that scan for vulnerable wallets and drain their holdings automatically.

Considering this, Scam Sniffer and Xiang urged crypto users to take extra care before signing wallet requests. They recommended verifying domain names, avoiding rushed confirmations, and rejecting signatures that seem unclear or overly broad.

They also stated that some of the red flags that could arise include requests for unlimited token approvals, contract upgrades under EIP-7702, or transaction simulations that do not match expectations.

Mentioned in this article

Hackers have started to exploit a critical remote code execution vulnerability in Wing FTP Server just one day after technical details on the flaw became public.

The observed attack ran multiple enumeration and reconnaissance commands followed by establishing persistence by creating new users.

The exploited Wing FTP Server vulnerability is tracked as CVE-2025-47812 and received the highest severity score. It is a combination of a null byte and Lua code injection that allows remote a unauthenticated attacker to execute code with the highest privileges on the system (root/SYSTEM).

Wing FTP Server is a powerful solution for managing secure file transfers that can execute Lua scripts, which is widely used in enterprise and SMB environments.

On June 30, security researcher Julien Ahrens published a technical write-up for CVE-2025-47812, explaining that the flaw stems from unsafe handling of null-terminated strings in C++ and improper input sanitization in Lua.

The researcher demonstrated how a null byte in the username field could bypass authentication checks and enable Lua code injection into session files.

When those files are subsequently executed by the server, it is possible to achieve arbitrary code execution as root/SYSTEM.

Along with CVE-2025-47812, the researcher presented another three flaws in Wing FTP:

• CVE-2025-27889 – allows exfiltrating user passwords via a crafted URL if the user submits a login form, due to unsafe inclusion of the password in a JavaScript variable (location)
• CVE-2025-47811 – Wing FTP runs as root/SYSTEM by default, with no sandboxing or privilege drop, making RCEs far more dangerous
• CVE-2025-47813 – supplying an overlong UID cookie reveals file system paths

All the flaws impact Wing FTP versions 7.4.3 and earlier. The vendor fixed the issues by releasing version 7.4.4 on May 14, 2025, except for CVE-2025-47811, which was deemed unimportant.

Threat researchers at managed cybersecurity platform Huntress created a proof-of-concept exploit for CVE-2025-47812 and show in the video below how hackers could leverage it in attacks:

Huntress researchers found that on July 1st, a day after technical details for CVE-2025-47812 appeared, at least one attacker exploited the vulnerability at one of their customers.

The attacker sent malformed login requests with null-byte-injected usernames, targeting ‘loginok.html.’ These inputs created malicious session .lua files that injected Lua code into the server.

The injected code was designed to hex-decode a payload and execute it via cmd.exe, using certutil to download malware from a remote location and execute it.

Huntress says that the same Wing FTP instance was targeted by five distinct IP addresses within a short time frame, potentially indicating mass-scanning and exploitation attempts by several threat actors.

The commands observed in these attempts were for reconnaissance, obtaining persistence in the environment, and data exfiltration using the cURL tool and webhook endpoint.

The hacker failed the attack “maybe due to their unfamiliarity with them, or because Microsoft Defender stopped part of their attack,” Huntress says. Nevertheless, the researchers observed clear exploitation of the critical Wing FTP Server vulnerability.

Even if Huntress observed failed attacks at their customers, hackers are likely to scan for reachable Wing FTP instances and try to take advantage of vulnerable servers.

Companies are strongly advised to upgrade to version 7.4.4 of the product as soon as possible.

If switching to a newer, secure version is not possible, the researchers’ recommendation is to disable or restrict HTTP/HTTPs access to the Wing FTP web portal, disable anonymous logins, and monitor the session directory for suspicious additions.

Two critical vulnerabilities affecting the open-source forum software vBulletin have been discovered, with one confirmed to be actively exploited in the wild.

The flaws, tracked under CVE-2025-48827 and CVE-2025-48828, and rated critical (CVSS v3 score: 10.0 and 9.0 respectively), are an API method invocation and a remote code execution (RCE) via template engine abuse flaws.

They impact vBulletin versions 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 when the platform runs on PHP 8.1 or later.

The vulnerabilities were likely patched quietly last year with the release of Patch Level 1 for all versions of the 6.* release branch, and version 5.7.5 Patch Level 3, but many sites remained exposed due to not upgrading.

Public PoC and active exploitation

The two issues were discovered on May 23, 2025, by security researcher Egidio Romano (EgiX), who explained how to exploit it via a detailed technical post on his blog.

The researcher showed that the flaw lies in vBulletin’s misuse of PHP’s Reflection API, which, due to behavioral changes introduced in PHP 8.1, allows protected methods to be invoked without explicit accessibility adjustments.

The vulnerability chain lies in the ability to invoke protected methods via crafted URLs and the misuse of template conditionals inside vBulletin’s template engine.

By injecting crafted template code using the vulnerable ‘replaceAdTemplate’ method, attackers bypass “unsafe function” filters using tricks like PHP variable function calls.

This results in fully remote, unauthenticated code execution on the underlying server — effectively granting attackers shell access as the web server user (www-data on Linux, for example).

On May 26, security researcher Ryan Dewhurst reported seeing exploitation attempts on honeypot logs showing requests to the vulnerable ‘ajax/api/ad/replaceAdTemplate’ endpoint.

Dewhurst traced one of the attackers to Poland, seeing attempts to deploy PHP backdoors to execute system commands.

The researcher noted that the attacks appear to be leveraging the exploit published earlier by Romano, though there have been Nuclei templates available for the flaw since May 24, 2025.

It is important to clarify that Dewhurst only observed exploitation attempts for CVE-2025-48827, but no evidence exists yet that attackers have successfully chained it to the full RCE, although this is highly likely.

vBulletin troubles

vBulletin is one of the most widely used commercial PHP/MySQL-based forum platforms, powering thousands of online communities globally.

Its modular design, including mobile APIs and AJAX interfaces, makes it a complex and flexible platform. However, it also exposes a broad attack surface.

In the past, hackers have leveraged severe flaws in the platform to breach popular forums and steal the sensitive data of large numbers of users.

Forum administrators are recommended to apply the security updates for their vBulletin installation or move to the latest release, version 6.1.1, which is not affected by the said flaws.

ZkLend, a decentralized lending protocol built on Starknet, has confirmed that the hacker responsible for its February exploit lost a significant portion of the stolen funds to a phishing scam.

In an April 1 post on X, ZkLend revealed that the attacker tried to launder 2,930 ETH, worth around $5.4 million, through crypto mixer Tornado Cash.

However, instead of using the legitimate platform, the hacker mistakenly interacted with a malicious phishing site: tornadoeth[.]cash. As a result, another party successfully drained the ETH.

Blockchain analytics firm Lookonchain corroborated ZkLend’s findings, confirming the loss of 2,930 ETH due to the phishing incident.

Interestingly, the hacker later sent an on-chain message to ZkLend’s deployer address, admitting the blunder. In the message, the attacker wrote:

“I tried to move funds to Tornado but used a phishing website. All the funds have been lost. I’m devastated and sorry for the havoc and losses caused. I don’t have the coins anymore.”

The hacker urged ZkLend to pursue the phishing site operators instead.

‘No connection’

This unexpected turn has fueled speculation that the original hacker and the phishing scammers might be connected, though no proof has surfaced to support that theory.

Meanwhile, ZkLend stated that the phishing website appears to have been active for over five years. The project furthered that no concrete evidence links the phishing operators to the original hacker.

Nonetheless, wallet addresses tied to the phishing site have been added to ongoing fund-tracing efforts.

The team also noted increased activity from wallets associated with the hacker. Security experts, centralized exchanges (CEXs), and relevant authorities were monitoring these movements in real-time.

ZkLend was exploited in February, with blockchain security firm Cyvers estimating the loss at approximately $9.5 million.

The protocol offered the attacker a 10% bounty if they returned the rest. However, the hacker ignored the proposal and kept the funds, prompting ZkLend to partner with security teams from Starknet, StarkWare, and Binance in a broader fund recovery effort.