Inferno Drainer: A Deep Dive into Crypto Wallet-Draining Malware

Group-IB details Inferno Drainer, a multichain wallet-draining malware active from November 2022 to November 2023 that operated as a scam-as-a-service: attackers hosted over 16,000 phishing domains impersonating more than 100 crypto brands, used spoofed Seaport/WalletConnect/Coinbase JavaScript libraries to trick users into approving malicious transactions, and reportedly stole at least USD $80 million; the report provides infrastructure analysis (domains, IPs, Telegram channels, panel behavior), script and ZIP file hashes, indicators of compromise, attack workflow, and recommendations to detect and mitigate these phishing drainers.