{"success":true,"data":{"id":"fake-opensea-blur-nft-bid-notification-phish","label":"Fake NFT bid / offer notification phish — email impersonates OpenSea, Blur, or Magic Eden with a fake \"you received a bid\" or \"your listing sold\" hook, directing to a drainer dApp for ERC-20 approval or seed-phrase entry. Chainalysis 2026; Certik Q1 2026.","description":"Email impersonating OpenSea, Blur, MagicEden, Foundation, or another NFT marketplace notification system claiming the recipient's listed NFT received a bid and directing them to accept/review at an off-platform URL — which leads to a wallet-connection page triggering a setApprovalForAll drain. This signal fills the gap between the existing fake-nft-whitelist-mint-wallet-drain-phish (which targets NFT buyers via fake whitelist/presale/mint opportunities) and this signal targeting NFT sellers receiving fake bid notifications. Abnormal Security's March 2026 threat intelligence report documented bulk OpenSea/Blur bid-notification template cloning; Bitdefender's BlurBid campaign report (February 2026) traced coordinated fake-Blur bid emails; Recorded Future's March 2026 research identified bid-notification phishing kits in phishing-as-a-service markets. Legitimate NFT marketplace bid notifications come from verified senders with DKIM signing, List-Unsubscribe headers, and links exclusively to official marketplace URLs.","tier":"danger","category":"phishing","isThin":false}}