FreeDrain Unmasked | Uncovering an Industrial-Scale Crypto Theft Network

FreeDrain is an industrial-scale, financially-motivated cryptocurrency phishing campaign that weaponizes search engine optimization, free-tier hosting platforms (gitbook.io, webflow.io, github.io, S3, Azure), and algorithmically-named redirector domains to serve lure pages which funnel victims to cloned wallet sites that collect seed phrases. Researchers identified over 38,000 distinct lure subdomains, extensive redirector domain lists, numerous active phishing endpoints and example exfiltration code, traced operational activity to UTC+05:30 (suggesting operators in the IST timezone), and provide IOCs and mitigation recommendations to help platform operators and defenders disrupt the campaign.