Fake Pudgy World site steals your crypto passwords

A phishing campaign impersonates the newly launched Pudgy World game (domain pudgypengu-gamegifts.live) to trick users into connecting crypto wallets by rendering highly convincing in-page forgeries of extension unlock screens and a Trezor Connect dialog; the site uses obfuscated JavaScript with VM/sandbox detection and staged payload delivery to evade automated analysis, and may steal passwords, seed phrases, or communicate with hardware-wallet bridges—mitigations and one IOC domain are provided.