Known malicious kitcriticalphishing

Copies of a BIP-39 converter that send the recovery phrase you enter to the site's server

family: trojanized-bip39-converter-2026-11

Look-alike copies of a well-known open-source BIP-39 converter, the tool that turns a wallet's recovery phrase into its keys and addresses. They work like the real tool, but send whatever phrase the visitor types or pastes to the site's own server. One copy, a rebuilt single-page app, sends the phrase with the optional passphrase, the derived seed and the BIP32 root private key to /api/notify as soon as the phrase is valid, and later the generated addresses as well. Another, a copied page, adds a function that posts anything longer than 50 characters to ./submit.php. Whoever runs the site can then empty the wallet. A recovery phrase should only ever be entered into a converter running offline. Sighted at bip39codeconverter[.]com and pathselector[.]app in 2026.

Anchors

Hunting ruleTrojanized_BIP39_Converter_Exfil
SMQL queryrun
domain:bip39codeconverter.com OR domain:pathselector.app

Provenance

Added: 2026-11-03 14:30
Matches the copies' own sending code, not the converter they copy, so the genuine tool and honest forks cannot match; the page title and look are the genuine tool's and are not used. The search adds the two known domains. Not the same kit as the fake wallet-recovery pages styled as a wallet app.

Sightings (4)Atom feed

HostScanScriptMatchScanned
bip39codeconverter.coma18744a8…https://bip39codeconverter.com/_next/static/chunks/0vodol0taiz97.jsrule2026-11-03 13:42
bip39codeconverter.coma18744a8…—query2026-11-03 13:42
pathselector.appa2b0887a…https://pathselector.app/#htmlrule2026-10-24 21:39
pathselector.appa2b0887a…—query2026-10-24 21:39