Flare Analysis Details Lucifer Crypto Drainer’s Affiliate Model and Tactics
Summary
Flare analyzed about 700 underground posts to document how Lucifer DaaS uses affiliates, wallet approvals, website cloning, and automated deployment. The article also lists warning signs of malicious wallet requests.
Key points
- Flare researchers analyzed about 700 posts related to Lucifer DaaS, collected from underground forums, chats, and channels between January 2025 and early 2026.
- The service's operators manage wallet interactions and transfers, while affiliates attract victims through phishing and fake websites; the operators said they took a 20% commission per successful hit.
- Lucifer advertised ERC20 support, Permit2 abuse, off-chain signatures, wallet-security bypasses, and multichain functionality.
- Website cloning and “Zero Config” deployment workflows were introduced to help affiliates generate phishing-ready packages with less manual work.
- After Telegram bots were banned in August 2025, the group instructed users to create new bots; after its documentation was suspended in November 2025, it moved documentation to IPFS.
- The article warns users about unexpected signature or approval requests, unlimited token permissions, urgent claim links, cloned sites, and prompts to disable wallet protections.
Article Details
- Attack Vectors
- Affiliates direct victims to fake crypto, NFT, airdrop, DeFi, or token-claim websites through phishing links, ads, spam, direct messages, and compromised social media accounts.
- Victims are tricked into connecting their wallets and approving malicious transactions, signatures, or token permissions, including Permit or Permit2 requests.
- Lucifer affiliates can clone phishing pages and use automated deployment workflows to publish phishing-ready sites.
- Defensive Notes
- Treat unexpected wallet connection, signature, approval, unlimited-approval, Permit, or Permit2 requests as warning signs, especially before receiving an asset.
- Verify a site's legitimacy before following claim or mint links, including links sent through Telegram, Discord, or X/Twitter DMs; beware urgency, cloned sites, and multiple redirects.
- Review transaction details carefully, heed wallet warnings, and avoid using a main wallet with substantial holdings on unknown Web3 sites.
- Be cautious of requests to disable wallet security protections, repeated requests to reconnect or re-sign, and unexpected wallet approval windows.
MITRE ATT&CK
T1204.001 · Malicious LinkVictims are induced to visit phishing pages and approve malicious wallet requests or signatures.T1566.002 · Spearphishing LinkAffiliates use phishing links and fake crypto, NFT, airdrop, or DeFi websites to lure victims.T1657 · Financial TheftThe drainer transfers cryptocurrency, tokens, or NFTs from victims' wallets to attacker-controlled wallets after approval.