Full Report
Inferno Drainer may have shut down in November 2023, but users of the devastating scam-as-a-service platform still pose a risk as they look for other avenues.
Analysis Summary
# Tool/Technique: Inferno Drainer
## Overview
Inferno Drainer was a prominent "Scam-as-a-Service" (SaaS) platform that specialized in multichain cryptocurrency theft. It operated by providing affiliates with malicious scripts designed to trick users into connecting their Web3 wallets to phishing sites, subsequently draining their digital assets (tokens and NFTs). Although the developers announced a shutdown in November 2023, the infrastructure and techniques established by the tool continue to influence the threat landscape.
## Technical Details
- **Type:** Malware family / Scam-as-a-Service (SaaS)
- **Platform:** Web-based (Targeting Web3 browser extensions and mobile wallets)
- **Capabilities:** Multichain asset draining, phishing, automated wallet permission requests, obfuscation.
- **First Seen:** Early 2023 (Active peak throughout 2023; announced closure November 2023).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566 - Phishing]
- **[TA0002 - Execution]**
- [T1204.001 - User Execution: Malicious Link]
- **[TA0007 - Discovery]**
- [T1652 - Device Characteristics] (Detecting installed wallet extensions)
- **[TA0010 - Exfiltration]**
- [T1567 - Exfiltration Over Web Service]
## Functionality
### Core Capabilities
- **Wallet Connection:** Utilizes libraries like `wallet-connect.js` and `coinbase.js` to prompt users to link their wallets to the malicious site.
- **Smart Contract Interaction:** Leverages scripts like `seaport.js` (mimicking OpenSea's protocol) to initiate malicious transactions.
- **Automated Asset Transfer:** Once a user approves a transaction, the script automatically identifies the most valuable assets (tokens and NFTs) and transfers them to the attacker's controlled addresses.
- **Multichain Support:** Capable of draining assets across various EVM-compatible blockchains (Ethereum, Binance Smart Chain, Polygon, etc.).
### Advanced Features
- **UI Mimicry:** Automatically generates high-quality phishing templates that impersonate legitimate NFT minting sites or popular airdrops.
- **Anti-Analysis:** Disables right-click functionality and specific hotkeys (F12, Ctrl+Shift+I) to prevent users/analysts from viewing the website's source code.
- **Affiliate Dashboard:** Provided a user-friendly interface for "customers" to track stolen funds, manage phishing domains, and customize drainer settings.
## Indicators of Compromise
- **File Names:**
- `seaport.js`
- `wallet-connect.js` (often versions v2 or v3)
- `coinbase.js`
- **Network Indicators:**
- `inferno-drainer[.]com` (Defanged)
- `api.inferno[.]io` (Defanged)
- **Behavioral Indicators:**
- Requests for "Set Approval For All" permissions on high-value NFT collections.
- Unexpected transaction prompts immediately after connecting a wallet to a new site.
- Website code containing `view-source:` blocks or disabled developer tool shortcuts.
## Associated Threat Actors
- **Inferno Drainer Developers:** The core group providing the service.
- **Unspecified Affiliates:** Hundreds of individual cybercriminals who paid a percentage of their "loot" (typically 20%) to the developers for use of the tool.
## Detection Methods
- **Signature-based detection:** Scanning website source code for specific script names (`seaport.js`, etc.) and unique JavaScript obfuscation patterns used by the Inferno framework.
- **Behavioral detection:** Monitoring for websites that immediately request broad token approvals (`approve` or `setApprovalForAll`) upon connection.
- **YARA Rules:** Can be crafted to detect the specific DOM structures and event listeners used by the drainer to hijack wallet interactions.
## Mitigation Strategies
- **User Education:** Advise users to never share seed phrases and to be wary of "free" airdrops or urgent minting events.
- **Technical Controls:** Use security-focused browser extensions (e.g., Wallet Guard, Pocket Universe) that simulate transactions before they are signed.
- **Due Diligence:** Verify website registration dates via WHOIS; sites less than 6 months old claiming to be major platforms are high-risk.
- **Hardening:** Disable "blind signing" on hardware wallets if the transaction details are not fully transparent.
## Related Tools/Techniques
- **MS Drainer:** A similar high-profile crypto drainer service.
- **Angel Drainer:** Another major competitor in the Scam-as-a-Service market.
- **Monkey Drainer:** One of the earliest prominent drainers that pioneered the affiliate model.