CoinMarketCap and Cointelegraph were compromised to serve wallet drainers via malicious pop-ups, while Trezor’s contact form was hacked.