Meme coin phishing scam disguised as Cloudflare check costs trader $600,000

A wave of fake Cloudflare verification pages is hitting meme coin traders, and at least one victim says the damage came to roughly $600,000. The scheme, flagged in market reports on September 16, shows how a meme coin phishing scam can bypass the usual wallet-approval trick entirely and instead push victims to run malicious code straight on their own computers.

Key takeaways

• Phishing pages disguised as Cloudflare verification screens are targeting meme coin traders on platforms like Axiom.
• Trader @cladzsol reported losing about $600,000 after running a script prompted by one of these fake pages.
• Attackers are hiding malicious links inside token metadata fields, the same fields traders check when researching new coins.
• Unlike typical wallet drainers, this attack asks victims to execute an administrator-level script on Windows rather than approve a blockchain transaction.
• Traders are urged to simply close any suspicious Cloudflare-style verification page instead of following its instructions.

Fake Cloudflare Phishing Scam Targets Meme Coin Traders

The core of this meme coin phishing scam is deceptively simple: a page that looks like a routine Cloudflare “verify you’re human” check, but that actually asks the user to run a script with administrator rights. Reports circulating on September 16 described several popular meme coin pages redirecting visitors to these fake screens, which then trigger scripts capable of draining a computer’s crypto holdings.

Execution of Malicious Scripts via Verification Pages

Once a trader clicks through the fake verification prompt, a malicious script can download and run on the machine. Crypto account @insidecalls described the mechanism directly, warning that a website would display a fake Cloudflare check before asking the user to run an admin payload script on Windows, “which will then drain your whole pc.” That single step, run under administrator privileges, is what separates this attack from far more common phishing formats.

Loss of $600,000 Reported by Trader

The clearest casualty so far is trader @cladzsol, described by @insidecalls as one of the top Axiom traders, who reported losing around $600,000 while attempting to bridge funds to Arc. According to the reports, the loss occurred after the fake verification prompt led to execution of the malicious payload. It’s one of the largest single losses tied to this specific style of attack reported so far.

Phishing Link Distribution through Token Metadata Manipulation

These phishing links aren’t spread through random ads or spam messages — they’re embedded in the metadata fields traders check while vetting new tokens. That detail matters because it means the scam hides inside the exact research step traders take to protect themselves.

Embedding Malicious Websites in Token Metadata

Meme coin projects typically list a website field and social links as part of their public metadata. Reports on the campaign said those fields can be edited by token creators, or by anyone who later gains control over a project’s online presence. That opens a path for attackers to swap in a malicious site where traders expect to find a legitimate homepage.

Role of Aggregation Platforms like DexScreener

Token tracking and trading aggregation platforms pull and display this same website and social data, and reports flagged concerns about delays in reviewing links shown by services such as DexScreener. No evidence in the reports indicated that DexScreener itself had been compromised, but the concern highlights how quickly a malicious link can reach traders once it’s slipped into a project’s metadata.

How the Fake Cloudflare Attack Differs from Typical Wallet-Draining Scams

Most wallet-draining scams rely on a trader connecting a wallet and signing off on a malicious blockchain transaction — the attacker needs an on-chain approval to move funds. This campaign skips that step. Instead, the fake Cloudflare page tries to get the victim to execute code directly on their computer, which means the attacker isn’t limited to whatever permissions a wallet approval would grant.

This distinction matters for anyone trading meme coins: a cautious trader who knows never to sign a suspicious transaction could still fall victim here, simply by running a script they believe is a routine security check. That’s precisely why the attack is drawing attention — it targets a blind spot that standard wallet-security habits don’t cover.

Related Malware Campaigns and Previous Crypto Phishing Incidents

This isn’t the first time crypto users have been pushed toward locally executed malware rather than on-chain approvals, and recent months show a pattern of phishing paired directly with malware built to harvest wallet data and credentials.

Phishing Combined with Malware for Wallet Theft

In August, a fake Claude desktop application distributed malware called RevStealer, capable of targeting more than 50 cryptocurrency wallets, according to cybersecurity firm Morphisec. The malicious file was disguised as “Claude Opus 5 Free Desktop” and could pull data from wallets, password managers and browsers on Windows systems before sending it to attacker-controlled servers. Separately, a May campaign used malicious developer packages to target crypto and AI developers; security platform Socket identified at least 34 malicious packages and 384 related versions spread across npm, PyPI and Rust ecosystems, aimed at collecting wallet data along with GitHub tokens, cloud credentials and API keys.

Past Malware Attacks on Meme Coin Traders

Meme coin traders in particular have been repeat targets, largely because they move fast between unfamiliar tools, social posts and project sites. In August 2024, Solana exchange aggregator Jupiter warned about a malicious Chrome extension called Bull Checker, promoted as a way to view meme coin holders, after users reported drained wallets; Jupiter’s investigation found it could alter transactions and redirect tokens to another address.

Against that backdrop, the September 16 warnings carry a clear, practical message: if a Cloudflare-style verification page asks for a command or script to be run, the safest move is to close it immediately without interacting further.

FAQ

How do meme coin phishing scams using fake Cloudflare verification work?

Fake Cloudflare verification pages trick traders into executing malicious scripts on their computers by asking them to run administrator-level commands.

How are phishing links distributed to meme coin traders?

Attackers embed phishing websites in token metadata fields that traders open while researching newly launched meme coins, often displayed by aggregation platforms like DexScreener.

How does the fake Cloudflare attack differ from typical wallet-draining scams?

Instead of asking users to approve malicious blockchain transactions, this attack makes victims execute code directly on their computers, enabling local malicious activities.

What should traders do if they encounter a suspicious Cloudflare verification page?

Traders are advised to close suspicious Cloudflare verification pages immediately and avoid executing any commands or scripts.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.