Skip to content
Trader Harley Lewis Foote Loses Funds in WhatsApp Malware Attack

Trader Harley Lewis Foote Loses Funds in WhatsApp Malware Attack

First seen 14 Nov 2026, 16:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 14, 2026 at 16:44 UTC
  • •Trader Harley Lewis Foote lost nearly all his funds in a WhatsApp malware attack.
  • •The attacker gained remote access without user interaction and monitored Foote's trading activity.
  • •Funds were withdrawn through multiple platforms, leaving Foote with only $800.

Trader Harley Lewis Foote reported losing nearly all his funds due to a malware attack via WhatsApp. The attacker gained full remote access to Foote's computer through a malicious payload that allegedly downloaded automatically. Over five days, the hacker monitored Foote's publicly disclosed short position and closed his trade as Bitcoin neared $68,000. The attacker withdrew funds using Hyperliquid, MetaMask, and Tornado Cash, leaving Foote with only $800. Additionally, the breach compromised Foote's email, passwords, website, and X account. Foote described the loss as 'years of savings and hard work.'

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 7h ago How this analysis works

Timeline

2026-11-14
Harley Lewis Foote reports malware attack
Trader Harley Lewis Foote disclosed that he lost nearly all his funds due to a malware attack via WhatsApp.
Phemex
2026-11-14
Details of the attack emerge
The attacker gained remote access through a malicious WhatsApp payload and monitored Foote's trading activities.
PANews

More articles in this cluster (2)

Extracted Entities (1)

1 / 2

Common questions

How did the attacker gain access?
The attacker gained access through a malicious WhatsApp payload that downloaded automatically.
What platforms were used for fund withdrawal?
Funds were withdrawn via Hyperliquid, MetaMask, and Tornado Cash.
What should affected users do?
Users should enhance their security measures, including updating software and monitoring accounts for unauthorized access.