Noir Wallet Drainer Uses DNS TXT Records and DoH to Rotate Infrastructure
Summary
Infoblox researchers describe Noir, a wallet drainer that uses DNS TXT records queried over public DoH to locate backend pools. It tailors approval requests to wallets, then uses captured permissions to transfer assets.
Key points
- The loader races three public DNS-over-HTTPS services to resolve a TXT record that identifies the current drainer pool.
- The kit also requests a fallback pool configuration; it caches the hostname for 60 seconds and retries if the current host fails.
- Lures use a shared engine and themes including fake voting, airdrop, eligibility-check, and exchange pages.
- Noir uses wallet addresses and portfolio estimates to request victim-specific plans, then seeks spending approvals or signatures rather than seed phrases or private keys.
- Captured permissions are sent to the backend, where an attacker-side relayer can use them to transfer assets; the kit disconnects the WalletConnect session afterward.
- Researchers observed pool infrastructure on render-984.pages[.]dev and identified _r.noir[.]black and noir[.]black as infrastructure indicators.
- The researchers recommend monitoring DNS and note that public DoH can bypass enterprise resolver paths.
Article Details
- Attack Vectors
- Fake cryptocurrency voting, airdrop, eligibility-check, and exchange-clone pages lure visitors into connecting a wallet.
- A JavaScript loader embedded in the lure queries a DNS TXT record through public DNS-over-HTTPS services to find the active drainer pool; an API configuration request provides a fallback pool.
- The drainer tailors approval and signature requests to the connected wallet, submits captured permissions to its backend, and uses an attacker-side relayer to transfer assets.
- The kit disconnects the WalletConnect session after the flow finishes, removing the malicious application from the wallet’s connected-applications list.
- Defensive Notes
- Monitor DNS activity, including TXT lookups, and consider blocking or tightly controlling access to public DNS-over-HTTPS services.
- Monitor for DNS configuration that redirects lure traffic to changing pool hosts, and account for short-lived infrastructure and fallback mechanisms.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | noir[.]black | Attacker-used domain hosting the API endpoint that supplies Noir road configuration and a fallback pool. |
| HOSTNAME | listchoiseopenleaderboardseptember[.]netlify[.]app | Host of a fake cryptocurrency voting lure page that embedded the drainer loader. |
| HOSTNAME | render-984[.]pages[.]dev | Drainer pool host returned by the malicious DNS configuration and used to serve the drainer script. |
MITRE ATT&CK
T1059.007 · JavaScriptJavaScript embedded in the lure is decoded and executed to initialize the Noir loader.T1071.004 · DNSThe loader queries a DNS TXT record through DoH to obtain the current drainer pool, using DNS as a control channel.T1657 · Financial TheftThe drainer obtains spending permissions through tailored approvals or signatures, then uses an attacker-side relayer to transfer victims’ assets.