Fake wallet-extension 'update' that opens a fake MetaMask, Trust, Phantom, Binance or Coinbase window and steals the recovery phrase

A copy of a crypto exchange (seen as a Changelly look-alike) asks the visitor to connect a wallet. Choosing MetaMask, Trust Wallet, Phantom, Binance or Coinbase Wallet starts a fake extension update ('Downloading packages', 'Installing update') and then draws a fake extension window inside the page. The window asks the visitor to import the wallet with its recovery phrase or private key, or walks them through 'creating' a wallet with a recovery phrase the page generated itself. The phrase, key and password are sent to a Telegram relay (telegram.php) on the same site, and the visitor is then sent on to the genuine exchange. Only recovery phrases with a valid checksum are accepted, so mistyped phrases are rejected and real ones go through. Sighted at cnangelly[.]com, registered 2026-08-12.