One Scan to Zero: The QR Code Trap Wiping Trust Wallets via Telegram

A Cyfirma analysis describes an active QR code-based drainer campaign on Telegram that leverages Trust Wallet deep links to Netlify-hosted phishing pages; victims are tricked into signing ERC-20 approve() transactions that grant attackers unlimited token allowance, enabling persistent wallet draining. The operation is modular and marketed as Drainer-as-a-Service, uses Telegram bots for real-time monitoring, and researchers observed evidence of active exploitation (at least 52 transaction notifications). Users are advised to verify requests, audit and revoke unlimited approvals, and be wary of Netlify-hosted USDT interfaces.