A new bookmark phishing attack is targeting users of the FOMO web platform, tricking victims into dragging malicious JavaScript code into their browser bookmarks under the guise of a fake CAPTCHA verification. After clicking the compromised bookmark two to three times, attackers hijack active FOMO sessions and immediately drain crypto assets from the account. Security researchers have documented samples of the phishing pages and preserved associated attacker wallet addresses for further investigation. Users are advised to avoid dragging any code into browser bookmarks during verification processes and to verify the legitimacy of authentication prompts on the FOMO platform.