NGRAVE LIQUID push notifications hijacked to phish wallet recovery phrases
Teaser from the source
On Oct 17 2026 attackers who had taken over access to the third-party provider that sends push notifications for NGRAVE's LIQUID wallet app sent users a fake security alert. It led to a copy of NGRAVE's website asking for the 24-word recovery phrase or Perfect Key, and anyone who entered one had their wallet drained within minutes. NGRAVE says the LIQUID app code and ZERO hardware wallets were not breached. Losses are estimated at roughly $2.56M to $2.65M.
This is the RSS-feed teaser. Read the full article at the original source.
Read at pwn.watchMore on notifications
Other advisories
- Not ratedosv:CVE-2026-98991namespace: queue a mount only once for mount notifications
- MediumCVE-2026-110882Cozy Vision Technologies Pvt. SMS Alert Order Notifications: fehlende Autorisierung
- HighCVE-2026-103895Das miniOrange OTP Login, Verification and SMS Notifications Plugin für WordPress ist in Versionen bis einschließlich 5.
- CriticalCVE-2026-104748Das Plugin SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications für WordPress ist in allen Versionen bis einschließlich 3.
- HighCVE-2026-83867Windows Push Notifications Elevation of Privilege Vulnerability
- HighCVE-2026-96313Windows Push Notifications Elevation of Privilege Vulnerability
- HighCVE-2026-70198Windows Push Notifications Elevation of Privilege Vulnerability
- Not ratedosv:CVE-2026-109600Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
Other news entries
- Oracle Health Data Breach Tally Climbs to Nearly 20 MillionNewsSecurityWeek
- ASOS Confirms Cyberattack, Data BreachNewsSecurityWeek
- ASOS confirms data breach after “HACKED” in-app notificationsNewsBleepingComputer
- NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 SessionsNewsThe Hacker News
- Apple Warns Users in 110 Countries They May Be Targets of Mercenary SpywareNewsThe Hacker News
- Google says Chrome cuts 7 billion unwanted Android notifications a day to fight abuseNewsBleepingComputer
- Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT MalwareNewsThe Hacker News
- ServiceNow fixes API issue after reports of suspicious tenant activityNewsCSO Online
Source: https://pwn.watch/i/ngrave-liquid-fake-push-alert-phishing
ID