Trap Phishing on Trusted Platforms: A New Phishing Trend in The Web3 World

This report describes an active Web3-targeted phishing campaign that places deceptive NFT listings and fake project pages on major marketplaces to lure users into downloading a malicious game client which harvests private keys and other wallet-sensitive files, compresses the data, and sends it to a C2 server (decoded IP: 5.42.65.55). The document includes social-engineering details, a focused malware analysis of sample behavior (password capture via osascript, targeted browser/wallet file reads, archiving and HTTP POST exfiltration), VirusTotal detection notes, sample variations, and recommendations for stronger marketplace vetting and user vigilance.