Full Report
Scammers are using fake tax authority emails to deploy crypto drainers. Discover how the declaration trap works and how to protect your digital assets.
Analysis Summary
# Tool/Technique: Crypto Drainer Tax Authority Phishing Campaign
## Overview
This technique involves a sophisticated social engineering campaign impersonating official government tax authorities (specifically the Dutch Tax and Customs Administration) to deploy **Crypto Drainers**. Unlike traditional reward-based lures (airdrops), this campaign uses "threat-based" social engineering, creating a sense of urgency regarding tax compliance to trick users into connecting their cryptocurrency wallets or providing seed phrases to a malicious web application designed to empty their assets.
## Technical Details
- **Type:** Malware (Crypto Drainer) / Phishing Technique
- **Platform:** Web-based (Browser / Web3 Wallets)
- **Capabilities:** Wallet connection (drainer), seed phrase harvesting, personal data exfiltration.
- **First Seen:** Early 2024 (associated with Dutch tax season lures).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment/Link]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery (Wallet detection)]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
- **[TA0002 - Execution]**
- [T1204.001 - User Execution: Malicious Link]
## Functionality
### Core Capabilities
- **Seed Phrase Harvesting:** The phishing pages include forms designed to look like official tax declarations that require users to input their wallet recovery phrases.
- **Wallet Connection:** Integration of Web3 scripts that prompt users to connect their browser-based wallets (e.g., MetaMask).
- **Personal Data Theft:** Scripts collect PII (Personally Identifiable Information) including names, addresses, and BSN (Dutch social security numbers) to bolster the legitimacy of the fraud.
### Advanced Features
- **Dynamic Validation:** Uses `globalScript.js` to validate form inputs in real-time, ensuring the attacker receives "clean" data.
- **Automated Exfiltration:** Uses `postman.js` to send harvested wallet credentials and personal data directly to the attacker’s backend API.
- **Geofencing/Contextual Lures:** The campaign specifically targets residents of the Netherlands by spoofing "MijnOverheid" and "Belastingdienst" branding.
## Indicators of Compromise
- **File Hashes (SHA256):**
- `342336d738165a465820f98e730cc39aeacfb47f90d7c09e4ec66bf5312e7e6f` (globalScript.js)
- `de94e8790ca66cde0920b7dd4e7a32f400400275326e4918096316180ad93c74` (postman.js)
- **Network Indicators (Defanged):**
- mijnoverheid-nl[.]com
- cryptoaangifteportaal[.]com
- belastingcryptotoeslagen[.]info
- securedauth-nl[.]su
- mijnaangifte-2025[.]com
- 176[.]65[.]134[.]35
- 66[.]63[.]187[.]130
- **Behavioral Indicators:**
- Redirects to Google after form submission.
- Unusual Web3 `request_accounts` calls on domains not associated with Decentralized Finance (DeFi).
## Associated Threat Actors
- Unknown; however, the TTPs align with actors operating "Drainer-as-a-Service" (DaaS) kits.
## Detection Methods
- **Signature-based detection:** Monitoring for the specific SHA256 hashes of the exfiltration scripts (`postman.js`).
- **Behavioral detection:** Identifying unexpected Web3 wallet connection requests on non-financial or government-impersonating domains.
- **URL Filtering:** Blocking access to newly registered domains (NRDs) containing keywords like "belasting," "mijnoverheid," or "aangifte" combined with "crypto."
## Mitigation Strategies
- **User Awareness:** Educate users that government agencies will never request seed phrases or private keys.
- **Domain Verification:** Implement DMARC/SPF/DKIM to identify spoofed emails and encourage users to verify URLs against official government bookmarks.
- **Hardware Wallets:** Use hardware wallets that require physical confirmation for transactions, reducing the efficacy of automated drainer scripts.
## Related Tools/Techniques
- **Inferno Drainer / MS Drainer:** Similar Web3-based asset theft frameworks.
- **Phishing-as-a-Service (PhaaS):** The use of pre-built templates for government impersonation.