Fake xStocks, Pendle, and other sites bait crypto users with rewards votes

1. Executive summary

Malwarebytes has identified 70 domains impersonating legitimate crypto projects, including xStocks (Kraken), Pendle, Zama, Kinetiq, Yield Basis, Firelight, Umia, Keeta, and NetNet, that present a fake "vote on the rewards date" prompt and route visitors into a wallet-connection flow. The domains follow a single naming pattern (sitemu plus random characters on .xyz), reuse identical templates across brands, and share one wallet-connection window, which points to a single operator or phishing kit rather than 70 independent campaigns. No CVSS score, CVE, or CISA KEV entry applies: this is a social-engineering and wallet-draining campaign, not a software vulnerability. The direct risk to EMEA financial services is limited to staff and clients who hold the impersonated tokens or use the named wallets, but the campaign is a live example of brand-impersonation infrastructure that can be repointed at any financial brand, and the wallet-approval mechanism it relies on is the same one used against institutional treasury wallets.

2. Regulatory framing

The source does not describe an incident at any regulated entity, a compromised ICT third-party provider, or a supply-chain compromise. Mapping DORA Art. 17, 18, 19, 28, 29, 30 or NIS2 Art. 21(2)(d), 23 to this item would be a compliance-checkbox exercise with no operational consequence. If a client's own staff or treasury wallet is later drained through one of these domains, DORA Art. 17 and 19 and NIS2 Art. 23 become engaged at that point, and the incident-management and reporting clocks start then.

3. Technical analysis & attack chain

The campaign is a brand-impersonation and wallet-draining operation. The confirmed steps below are drawn from the Malwarebytes report; the operator's identity, hosting, and any downstream cash-out infrastructure are not described in the source.

1. A victim receives or finds a link to a domain matching the pattern sitemu<random>.xyz. The source does not state the distribution channel (search, social, direct message, or paid placement).
2. The domain serves a page that copies the target project's logo, menus, and colours. The Firelight copy reproduces a real announcement about the protocol's deposit cap, which indicates the pages were copied from the live sites rather than rebuilt.
3. The page presents a rewards-vote offer. Most variants promise a 1.25x boost for voting on the rewards distribution date. Variants: the Pendle copy adds fake dates and a countdown, the Keeta copy promises points, and the NetNet copy skips the vote and warns that unclaimed tokens will be burned after 48 hours.
4. Clicking "Vote now" does not open a ballot. It opens a "Connect Wallet" window that is identical across all impersonated brands. The window lists WalletConnect, MetaMask, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, and Rabby, plus an option to browse more than 28 others.
5. Connecting a wallet shares the wallet address, which lets the site look up holdings. At this stage the site has no permission to spend tokens.
6. The source states that in wallet-draining scams the damage comes from the next request: a message-signing or transaction-approval prompt presented as confirmation of the action the visitor intended. A malicious approval or signature grants permission to move tokens without further confirmation.
7. Blockchain transactions are generally irreversible, so stolen funds are difficult to recover.

Shared-infrastructure evidence. All 70 domains follow the sitemu + random string + .xyz pattern. Templates are reused across brands with near-identical wording, including the boost written as 1,25x with a comma decimal separator, which is consistent with a European locale or a copied template. The wallet-connection window is identical across brands. The source assesses this as a shared operation or phishing kit; that assessment is single-sourced to Malwarebytes and is not corroborated by a second vendor in the material provided.

Target selection. The source states the target list is not random. Zama ran a public token auction in January and its token began trading in February; Kinetiq launched its governance token with an airdrop to early users in November 2025; Umia's token auction ran from 29 August to 2 September; Firelight awards points to early depositors; Pendle launched on Robinhood Chain on 4 September. The lure is aimed at people who already hold the token or have used the protocol and would expect a distribution.

What the source does not provide. No hosting provider, registrar, ASN, IP address, TLS certificate detail, JavaScript filename, wallet-drainer contract address, or threat-actor attribution is given. The report does not name a malware family, does not state whether the pages serve a drainer script or hand off to a third-party drainer service, and does not describe any post-connection exfiltration beyond the on-chain approval. Treat any attribution to a named group as unconfirmed; there is none in the source.

4. Mitigation & containment

P1 (within 24 hours)

• Block the 70 sitemu*.xyz domains at the DNS resolver, secure web gateway, and endpoint web-protection layer. The full list is in §5. Because the operator rotates domains on the same pattern, add a wildcard block for sitemu*.xyz rather than relying on the enumerated list alone.
• Push an internal advisory to staff who hold the impersonated tokens (xStocks, Pendle, Zama, Kinetiq, Yield Basis, Firelight, Umia, Keeta, NetNet) or use the named wallets, stating that no legitimate rewards vote requires a wallet connection and that the sitemu*.xyz pattern is the giveaway.
• If any corporate or treasury wallet has interacted with a sitemu*.xyz domain, treat the wallet as compromised. Revoke token approvals for the affected address using the wallet's approval-management interface, and move remaining assets to a new address with a fresh seed phrase.

P2 (within 72 hours)

• Add the sitemu*.xyz pattern and the wallet-connection behaviour to phishing-detection rules in the email gateway and browser-protection tooling.
• Confirm that browser-protection or scam-blocking tooling is deployed and current on all endpoints that can reach the public internet. Malwarebytes Browser Guard is named in the source as blocking known phishing and scam sites; equivalent controls from other vendors serve the same purpose.
• Brief client-facing teams so that any client reporting a suspicious rewards or airdrop link is routed to the fraud team rather than handled as a generic phishing query.

P3 (within 7 days)

• Add a standing control to the crypto-asset or digital-asset desk procedure: verify any rewards, vote, claim, or airdrop offer through the project's official channels before connecting a wallet. The source states this explicitly and it is the only control that defeats the lure regardless of domain rotation.
• Review whether any client-facing communications reference the impersonated projects, and add a warning if so.

5. Indicators of compromise

All indicators below are domains from the Malwarebytes report. They are defanged for publication. The domain set is single-sourced to Malwarebytes; verify before enforcement.

domain  sitemufl06qs0r4o[.]xyz
domain  sitemui6m6bbj1bd[.]xyz
domain  sitemui8go6g99bb[.]xyz
domain  sitemuicitd4jrtr[.]xyz
domain  sitemuidkr38kji0[.]xyz
domain  sitemuidlij5urd0[.]xyz
domain  sitemuif3pa5k4eh[.]xyz
domain  sitemuife3h91vjj[.]xyz
domain  sitemuioeefbyh3i[.]xyz
domain  sitemuioi7005ekb[.]xyz
domain  sitemuizkhpdbjnv[.]xyz
domain  sitemuj1xencnin8[.]xyz
domain  sitemuj7lzbasipw[.]xyz
domain  sitemujbcz1nas1x[.]xyz
domain  sitemujdi54aitrf[.]xyz
domain  sitemujejvp4tp0x[.]xyz
domain  sitemujffobdhxgj[.]xyz
domain  sitemuji07m137aw[.]xyz
domain  sitemujoqrmsm0et[.]xyz
domain  sitemujrfn7witew[.]xyz
domain  sitemujsm7brhwh0[.]xyz
domain  sitemujtcvh5q9fj[.]xyz
domain  sitemujtd8ingh2b[.]xyz
domain  sitemujtdkvy6c7n[.]xyz
domain  sitemujufht1ntj4[.]xyz
domain  sitemujufs1975v4[.]xyz
domain  sitemujug76lkyke[.]xyz
domain  sitemujumvtmjaf1[.]xyz
domain  sitemujuncdlpnng[.]xyz
domain  sitemujuno47vpud[.]xyz
domain  sitemujunzgjapds[.]xyz
domain  sitemujw19idqe01[.]xyz
domain  sitemujw1uspghl1[.]xyz
domain  sitemujwcvm5ufu8[.]xyz
domain  sitemujxjlv2lmhh[.]xyz
domain  sitemuk3jcm1olr8[.]xyz
domain  sitemuk3jpe1eph7[.]xyz
domain  sitemuk3z1hh2tvn[.]xyz
domain  sitemuk3zjrr2ufy[.]xyz
domain  sitemuk3zu5776gi[.]xyz
domain  sitemuk6zd201nsw[.]xyz
domain  sitemuk7f31386dx[.]xyz
domain  sitemuk7fi1dcrp4[.]xyz
domain  sitemuk7fvnvihra[.]xyz
domain  sitemuk7xbyszpzj[.]xyz
domain  sitemuk7y434m4om[.]xyz
domain  sitemuk7yi5eqn74[.]xyz
domain  sitemuk7ys6db9qj[.]xyz
domain  sitemuk9ayiwadjz[.]xyz
domain  sitemuk9c4oppeco[.]xyz
domain  sitemukh5awm67rj[.]xyz
domain  sitemukpy2hpmpwv[.]xyz
domain  sitemukrod1am6ez[.]xyz
domain  sitemukvxv7j5hmv[.]xyz
domain  sitemukvy7wudsqb[.]xyz
domain  sitemukww7ivnaji[.]xyz
domain  sitemukwxih8302f[.]xyz
domain  sitemul94tcv4l80[.]xyz
domain  sitemul95f18sowo[.]xyz
domain  sitemul95pxqgmm8[.]xyz
domain  sitemulaay8dbm66[.]xyz
domain  sitemulaucnbmnrd[.]xyz
domain  sitemulffos1qryn[.]xyz
domain  sitemuli8pd7qi9z[.]xyz
domain  sitemulpmt6if530[.]xyz
domain  sitemulpnff7964j[.]xyz
domain  sitemulpo7jkntfz[.]xyz
domain  sitemulr9d1dg77r[.]xyz
domain  sitemuls00qrsh0k[.]xyz
domain  sitemulszq4rm2yn[.]xyz

Behavioural indicators

The source describes behaviours rather than atomic host artefacts. These are the observables to hunt for.

6. Detection

The source provides no file hashes, no malware strings, and no host artefacts. The only machine-pivotable artefacts are the domains and the sitemu*.xyz naming pattern. A YARA rule is not appropriate here because there is no file content to match. The Sigma rule below targets DNS and proxy telemetry for the domain pattern.

title: DNS or proxy request to sitemu-pattern crypto phishing domains
id: 8f3c2a91-4d7e-4b16-9a2c-1e5f7b0d3c48
status: experimental
description: Detects DNS queries or HTTP proxy requests to domains matching the sitemu<random>.xyz pattern used by the crypto rewards-vote phishing campaign reported by Malwarebytes on 2026-10-01.
author: Adverse Trace
date: 2026-10-01
references:

  - https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-xstocks-pendle-and-other-sites-bait-crypto-users-with-rewards-votes
logsource:
  category: dns
detection:
  selection_dns:
    QueryName|re: '^sitemu[a-z0-9]+\.xyz$'
  selection_proxy:
    c-uri|re: '^https?://sitemu[a-z0-9]+\.xyz/'
  condition: selection_dns or selection_proxy
fields:

  - QueryName
  - c-uri
  - Computer
  - User
falsepositives:

  - None expected. The sitemu prefix on .xyz is not a known legitimate naming convention.
level: high

For environments without DNS logging, the equivalent control is a web-proxy or secure-web-gateway rule matching the same regular expression against the request host. The wildcard block recommended in §4 covers the same ground at the resolver.

7. Sources

• Malwarebytes, "Fake xStocks, Pendle, and other sites bait crypto users with rewards votes", https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-xstocks-pendle-and-other-sites-bait-crypto-users-with-rewards-votes, 2026-10-01.

This advisory rests on a single vendor report. The domain list, the shared-infrastructure assessment, and the wallet-connection behaviour are all single-sourced to Malwarebytes. No second vendor, CERT, or law-enforcement source corroborates the campaign in the material provided. Verify the domain list against your own telemetry before enforcing a block, and treat the "single operation or phishing kit" assessment as an analyst judgement rather than a confirmed attribution.

8. Adverse Trace position

Adverse Trace assesses this as a moderate-severity, high-volume brand-impersonation campaign with no direct exposure to EMEA financial services infrastructure. There is no CVE, no CVSS score, and no CISA KEV entry, so it does not enter the vulnerability-management queue. The risk to clients is indirect: staff and clients who hold the impersonated tokens can be drained through a single wallet approval, and the same sitemu*.xyz template infrastructure can be repointed at a bank's brand with minimal effort. We will add the 70 domains and the sitemu*.xyz wildcard to our blocklist feed, monitor for new domains on the same pattern, and re-issue this advisory if a second source corroborates the campaign or if any domain is observed targeting a financial brand. Clients with a digital-asset desk should treat the wallet-approval verification step in §4 P3 as the control that matters, because domain rotation defeats any static blocklist.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.