Amidst the soaring market cap of the crypto sector, currently standing at $1.66 trillion (approximately Rs. 138,06,635 crore), cybercriminals continue to exploit vulnerabilities within this domain. These malicious actors frequently exploit novel tools and applications to infiltrate crypto protocols, aiming to pilfer these digital assets.
The most recent addition to their arsenal is the ‘drainer,’ a tool employed by hackers to compromise crypto holdings. Reports from various research platforms highlight the proliferation of these drainers through advertisements on platforms like Google and X.
According to findings detailed in a report by Bleeping Computer, over ten thousand phishing websites have been identified utilizing the ‘MS Drainer.’ Notably, many of these fraudulent websites are disguised as ads on Google and X, amplifying the scope of their reach and potential impact.
What is a ‘Drainer’?
This drainer tool has facilitated cybercriminals in victimizing a staggering 63,210 individuals, resulting in a reported theft of $59 million (approximately Rs. 490 crores) between March and November of this year. This alarming trend underscores the pressing need for heightened vigilance and security measures within the crypto landscape to safeguard against these sophisticated cyber threats.
A drainer, essentially a smart contract embedded with malicious code, serves as a potent tool targeting crypto protocols. Crafted as an all-in-one suite for phishing, these drainers enable perpetrators to surreptitiously breach the intended crypto wallets of their targets.
Typically concealed within deceptive phishing websites, these drainers present an illusion of legitimacy. Upon interaction with these seemingly authentic sites by unsuspecting members of the crypto community, drainers gain access to the victim’s crypto wallet associated with their identity.
This unauthorized access empowers hackers to execute transactions, siphoning off the victim’s assets into alternate wallets of their choosing.
According to the report by Bleeping Computers, the source code for developing these drainer toolkits is being vended at $1,500 (approximately Rs. 1.24 lakh) by an individual identified as ‘Pakulichev’ or ‘PhishLab’.
Advertisements to Lookout and Beware of
Advertisements on platforms like Google, subtly concealed as phishing websites, are often linked to keywords such as Zapper, Lido, Stargate, Defillama, Orbiter Finance, and Radiant. Similarly, on X (formerly Twitter), these drainer ads proliferate, enticing users through fabricated NFT and token drop announcements, among other deceptive strategies.
Despite recurrent warnings, tech giants like Google and X remain susceptible to these malicious crypto ads infesting their platforms.
In April this year, ScamSniffer, a cybersecurity service, disclosed that crypto investors had incurred losses totaling up to $4 million (approximately Rs. 35 crores) due to engagement with spurious links scattered across the internet. This information was gleaned from an analysis of Google Ads data, underscoring the persistent threat posed by these fraudulent schemes.