SlowMist: Beware of browser history pollution attacks, malicious software attacks are on the rise again

On December 31, SlowMist released an analysis of security incidents in Q4 2025, which mentioned a new, more covert phishing method: even if users manually enter the correct official domain name, they may still be redirected to a phishing website. Some victims reported that despite entering the correct address, their browser would automatically autocomplete it to a forged impersonation domain created by attackers. This is not due to user error, but because attackers have previously polluted the browser’s history through ads, social media guidance, or false announcements. Once the phishing domain is stored in the browser’s autocomplete logic, the next time the user inputs that address, the browser will automatically redirect to a fake website that looks almost identical to the official site. Additionally, malware attacks on computers have re-emerged. Attackers often use phishing links, private messages in social tools, or so-called “resource downloads” to quietly implant malicious programs into the user’s local environment. Once infected, data related to wallets faces potential risks.