According to 23pds, Chief Information Security Officer of SlowMist, who retweeted a post by X platform user @Miles082510, the developer @web3_cryptoguy is posing as a Web3 "tool author" to provide malicious script tools. These tools scan the user's local sensitive files in the background, steal key data such as private keys, wallet files, and mnemonic phrases, and upload them to an anonymous server. The whole process is difficult to detect. SlowMist reminds users to avoid using script tools from unknown sources to prevent asset losses. [ChainCatcher]