Meme coin phishing pages trick traders with fake Cloudflare checks

Meme coin traders have been targeted by phishing pages disguised as Cloudflare verification screens, with one trader reporting a loss of approximately $600,000 after running a malicious script. Summary Fake Cloudflare verification pages linked to meme coins are being used to trick traders into executing malicious scripts. Crypto trader @cladzsol reported losing approximately $600,000 after interacting with one of the malicious pages. Attackers can place phishing websites in token metadata fields that traders may open while researching newly launched meme coins. Users have been warned to close suspicious verification pages that ask them to execute commands or scripts on their computers. Market reports on Sept. 16 said several popular meme coin pages have been redirecting visitors to fake verification screens that instruct them to execute commands on their computers, allowing malicious scripts to run and potentially steal crypto assets. 🚨one of the best Axiom traders just got drained for $600k while trying to bridge to @arc A website will verify a fake cloudfare and asks you to run an admin payload script into your windows which will then drain your whole pc. DO NOT DO THIS. QT'ing for awareness. https://t.co/igJUo8jAy6pic.twitter.com/KFmdBP8H8j — Inside Calls (@insidecalls) September 15, 2026 Crypto trader @cladzsol said he lost around $600,000 in the incident, while crypto account @insidecalls warned that the attack involved a website displaying a fake Cloudflare check before asking the user to run a payload with administrator privileges on Windows. The method differs from many wallet-draining attacks that rely on users connecting a wallet and approving a malicious blockchain transaction. In this case, the phishing page attempts to get the victim to execute code directly on the computer. Meme coin phishing pages use fake verification prompts The malicious links have appeared through website fields attached to meme coins. Traders scanning newly launched tokens may open those links while researching a project, only to land on a page designed to resemble a legitimate Cloudflare verification check. Once the user follows the instructions on the page, a malicious script can be downloaded and executed on the computer, according to the reports. Inside Calls described a similar sequence when discussing the loss suffered by @cladzsol, saying the fake verification process asks the user to run an administrator payload on Windows. The trader subsequently said the incident had cost him $600,000. You might also like: Hunter Biden to launch LAPTOP meme coin with airdrop for TRUMP holders The attack relies partly on the routine behavior of meme coin traders, who often move quickly between token pages, social accounts and project websites while looking for newly launched assets. Some token tracking and trading aggregation platforms display website and social media information pulled from token metadata.