Threat actors are temporarily redirecting phishing domains to phantom.app/download to avoid detection

[0xgumby]

When submitting URLs to the blocklist, I noticed that some would temporarily get blocked from the extension and then become unblocked. Upon scanning them, quite a few have redirected to the legitimate Phantom download page.

There's a possibility they are using something like https://github.com/oftn-oswg/zerodrop in order to redirect when certain conditions are met.

https://urlscan.io/search/#phantom.app