Security company Salus: Users lost 550,000 USDC due to clicking on Google sponsored ads

According to security company Salus monitoring, a user lost approximately 550,000 USDC after clicking on a Google sponsored ad that led to a counterfeit Hyperliquid website. This case utilized specialized "coin theft service" infrastructure associated with the Inferno system. The relevant services attract customers through Telegram accounts, offering malicious scripts, automatic theft, cross-chain withdrawals, and automatic profit sharing functions.

In this case, the phishing gang was responsible for purchasing ads, deploying counterfeit entry points, and providing the final collection address; after the theft of coins was successful, the backend automatically completed the fund splitting. The total amount involved by the relevant gang is approximately 52.74 million USD, which has been linked to multiple significant phishing incidents, such as on September 23, 2025, when the original attacker of UXLINK encountered a second authorization phishing, resulting in about 542 million UXLINK; on April 15, 2026, the official domain of CoW.fi was hijacked, with associated losses of 316,000 USDC; on July 9, 2026, a fake DApp/fake airdrop authorization phishing stole about 1 million USDT. Salus stated that the relevant evidence and high-risk addresses have been submitted to the appropriate authorities for handling.