MALWAREBYTES reports a phishing campaign that impersonates Pudgy World, the newly launched Pudgy Penguins browser game, to steal crypto passwords. The fraudulent site, pudgypengu-gamegifts[.]live, appeared around the game’s launch window, with Pudgy World going live on 10 March 2026, and the article notes the campaign was active in that period.
The fake site replicates the official wallet connection prompt, presenting a wallet list including MetaMask, Trust Wallet, Coinbase Wallet, Ledger, Trezor Wallet, and others, and then shows an overlay that mimics the wallet’s unlock screen to trap users into entering credentials.
It targets both software and hardware wallets, using a WebUSB prompt to prompt a device connection and, in the case of Trezor, a simulated Connect interface that can lead users to disclose their seed phrase if they fall back to a manual option.
The piece highlights how the site hides its malicious functionality behind obfuscated JavaScript and a staged payload that only loads for real users, and it urges readers to bookmark the official Pudgy Penguins site and to use Malwarebytes Browser Guard to block known phishing domains.