{"success":true,"data":{"id":"fake-web3-wallet-drainer-signature-lure","label":"Fake MetaMask / Phantom / Coinbase Wallet / Rainbow / Trust Wallet signature-drainer lure — \"pending transaction / airdrop claim / approve permit, connect wallet to sign within 24 hours\" targeting self-custody Web3 wallet users; malicious setApprovalForAll or permit signature = complete + IRREVERSIBLE wallet drain (Chainalysis 2024: $500M+ lost to drainers, typical victim $5-50K, NFT whales $1-10M)","description":"Fake \"your MetaMask / Coinbase Wallet / Phantom / Rainbow / Trust Wallet received a pending transaction — connect to review and sign within 24 hours\" email targeting Web3 wallet users. Distinct from the centralized-exchange phish class (`fake-coinbase-exchange-alert-lure`) because this targets **self-custody wallets where a malicious signature is immediate, irreversible, and un-recoverable**. Attack shape: email urges user to connect wallet at a fake dApp; user signs what looks like a benign \"review pending transaction\"; the actual signed call is `setApprovalForAll` or `permit` giving the attacker unlimited allowance on ALL the user's tokens/NFTs; attacker drains wallet within minutes. Post-compromise: full ERC-20 token balance drained via permit/approve; all NFTs transferred via setApprovalForAll; wallet-connected dApp positions (DEX, staking, etc.) compromised. No recourse — signatures on immutable blockchains cannot be reversed, no insurance, no chargeback. 2024 Chainalysis data: wallet-drainer attacks cost users $500M+ in 2024 alone; typical victim loses $5-50K; high-NFT whales lose $1-10M. The lure converts because Web3 users ARE expected to sign transactions frequently, real wallet notifications look nearly identical, and fear of missing an airdrop or NFT claim overrides caution. Fires when body references MetaMask / Phantom / Coinbase Wallet / Rainbow / Trust Wallet / WalletConnect / self-custody / seed phrase / setApprovalForAll / permit / signature request / Web3 wallet AND contains connect-wallet / sign-transaction / pending-approval / airdrop-claim / approve-permit urgency. Excludes metamask.io, consensys.io, coinbase.com, phantom.app, rainbow.me, trustwallet.com, walletconnect.com, ledger.com, trezor.io. Auto-classified as danger via the `-lure` suffix.","tier":"danger","category":"phishing","isThin":false}}