Uniswap-Impersonation Google Ads Phishing (AngelFerno Drainer)

Timeline: Publicly flagged on 25 May 2026 by on-chain analyst b-block, this is a wallet-drainer phishing campaign using sponsored Google Search ads that impersonate Uniswap (sometimes via Cyrillic/Punycode lookalike domains). A victim clicks the sponsored result above the legitimate uniswap.org link, connects a wallet to a cloned UI, and signs an unlimited token approval; the AngelFerno scam-as-a-service drainer then empties the wallet. On-chain activity on the two identified attacker wallets (0x3792...49Bb, 0x2fC2...c5E2) runs from 12 May to 29 May 2026 -- a continuous campaign that straddles the 23-29 May window, with the public alert and a visible peak on 25 May. The largest observed inflows include PAXG ~$21K (21 May), USDC ~$17.8K (24 May), USDT ~$5.1K (12 May) and Mog ~$1.7K (22 May). Stolen assets are consolidated toward 0x66a9893cC07D... and 0x7f54f05635.... SEAL had previously reported $1.27M lost between 13-30 March 2026 from the same broader Google Ads phishing wave, and described a steady weekly volume of attacker-deployed ads for over a year. b-block put the tracked loss at >=$400K (the two wallets together held ~146 ETH, ~$306K, at tracking time); the $400K tier-1 figure is retained, while only ~$49K is directly USD-traceable on the two observed wallets because many drained tokens are illiquid and because this is a subset of a larger multi-wallet operation. ZachXBT publicly called for criminal liability for Google executives. The campaign remains active; recovery: 0%.