According to online reports, according to 23pds, chief information security officer of Slowfog, who forwarded an exposed post from X platform user@Miles082510, developer@web3_cryptoguy pretended to be a Web3 "tool author" to provide malicious scripting tools. The tool scans the user's local sensitive files in the background, steals key data such as private keys, wallet files, and mnemonics and uploads it to an anonymous server, making the whole process difficult to detect. Slow fog reminds users to avoid using scripting tools from unknown sources to prevent asset loss.