🚨 Warning about a suspicious Rocket Legacy recruitment pitch from @joysuswhos. I was offered a crypto-paid moderator job, then told to install a “game” and proceed despite possible Windows Defender warnings. I stopped before downloading anything. Here’s what happened—and what we found in the website’s code. 🧵 1/ The approach The account contacted me offering a moderator role: • 3 hours per day • 3 days per week • $85/hour • $765 per week, paid in cryptocurrency The described responsibilities were handling support tickets, reviewing community performance, and helping users create game accounts. 2/ Moving to Discord They directed me to @rocketworlds and a Rocket Legacy GitBook whitepaper, then moved the conversation to Discord under the name “Joy sus”/“Joy sus” as shown in the attached screenshots. Correction for clarity: the Discord display name in my screenshots is “Joy sus” without a space: “Joy sus” → “Joy sus”. 3/ The requirement changed to installing software I was told: “Yes you need to download it and run it just to check your username and id. But you are not to connect ur wallet” They then sent a link on rocketlegacybeta[.]xyz with a referral-style parameter, ?v=74YY, and instructed me to use Chrome, download the Windows version, and create an in-game ID before proceeding. 4/ The biggest warning sign Their installation instructions included: “there might be a few bumps on pc windows defender, you can proceed with install or more info, no problem.” They were explicitly preparing me to continue despite a security warning. Being told that wallet connection isn’t required does not establish that a download is safe. 5/ What the website’s code revealed Instead of downloading the game, I inspected the Play Now button in Developer Tools. It calls submitForm(event), which first runs detectExtensions(). That function attempts to detect dozens of crypto wallets, including MetaMask, Phantom, Coinbase Wallet, Rabby, Trust Wallet, and others. 6/ It also checks for other extensions The detection code includes password managers such as LastPass, 1Password, Bitwarden, and Dashlane, alongside ad blockers, privacy/security tools, and developer extensions. Some checks may fail. The important finding is that the site explicitly attempts this profiling before providing a download. 7/ Where that information goes When Play Now is clicked, the code is written to POST these fields to /api/rest.php: • ua — browser/device information • code — a stored code or the link’s “v” parameter • type — “download” • ext — detected extension names The server then returns a download link. The page handles Windows and Mac differently and rejects mobile devices. 8/ What this proves—and what it doesn’t The code shows attempted extension detection and reporting to the server. It does NOT, by itself, prove that passwords, seed phrases, private keys, or funds were stolen. I did not download or run the installer, so I cannot say what that file does. Detecting a wallet extension is different from accessing its secrets. 9/ There is also independent historical context Recorded Future’s Insikt Group named Rocket Galaxy—formerly Rocket Legacy—in its January 23, 2025 report on crypto scams. Page 12 discusses shared tracking infrastructure and website-code overlaps with another scam operation. The researchers also said they could not obtain a Rocket Legacy/Galaxy malware sample at that time. Source: assets.recordedfuture.com/in… 10/ Attribution matters That report names older handles, @rocketlegacynft and @rocketglxworld. It does not establish who currently controls @joysuswhos or @rocketworlds. My screenshots document what the account contacting me said and the site it directed me to. I cannot verify the operator’s real identity or whether the account has changed hands. 11/ Why I’m sharing this An unsolicited paid role led to a required software installation, browser-extension profiling, and instructions to proceed despite Defender warnings. That combination is enough for me to walk away. I downloaded nothing, ran nothing, and connected no wallet. Screenshots and the inspected code are attached so others can assess the evidence. Please don’t visit the domain to “test” it or harass anyone. Preserve evidence and report suspicious recruitment messages through the platform.