An active phishing campaign abuses Trust Wallet's deep link mechanism by sending malicious QR codes through Telegram. These QR codes lead victims to Netlify-hosted phishing domains that impersonate legitimate USDT transfer interfaces. When victims interact, the phishing site covertly initiates an ERC-20 approve() transaction granting unlimited token allowance to attacker-controlled contracts on the BNB Smart Chain. This allows attackers to drain funds persistently without additional victim actions. The campaign infrastructure includes modular JavaScript components (config.js and main.js) for control and execution, and a Telegram bot for real-time transaction monitoring. Multiple cloned phishing domains suggest a Drainer-as-a-Service model facilitating scalable exploitation.

Successful exploitation results in victims unknowingly granting unlimited USDT token approval to attacker-controlled contracts, enabling attackers to drain victims' wallets repeatedly without further consent. This leads to direct financial loss of cryptocurrency assets from affected Trust Wallet users. The campaign's use of social engineering and phishing increases the risk of widespread victimization.

No official patch or vendor advisory is currently available for this threat. Users of Trust Wallet should exercise extreme caution when scanning QR codes from untrusted sources, especially those received via Telegram or other messaging platforms. Avoid interacting with suspicious links or interfaces requesting token approvals. Monitoring for unusual token approval transactions in wallets can help detect compromise early. Since this is a phishing-based attack, user awareness and skepticism toward unsolicited QR codes and links are critical.