Noir Wallet Drainer Uses DNS-over-HTTPS to Locate Its Control Infrastructure
Summary
Researchers describe Noir, a crypto wallet drainer that uses DNS TXT records and public DoH services to locate replaceable backend infrastructure, then steals assets through tailored wallet approvals and signatures.
Key points
- Noir’s loader races queries to three public DNS-over-HTTPS services for a TXT record that identifies the active drainer pool.
- Operators can redirect existing lure pages by changing the DNS record rather than rebuilding or replacing the lures.
- A secondary configuration endpoint can supply a fallback pool; the loader caches the pool for 60 seconds and retries if it fails.
- Victims connect their wallets and may grant tailored spending permissions through signatures or approval transactions; the attacker then executes transfers from its own infrastructure.
- The kit disconnects the WalletConnect session after the flow, potentially removing an obvious sign of the malicious connection.
- Shared infrastructure and configuration identifiers link a common drainer engine to many fake voting, airdrop, eligibility-check, and exchange lures.
- The researchers identify public DoH and DNS-based live configuration as resilient C2 techniques defenders should monitor.
Article Details
- Attack Vectors
- Fake cryptocurrency voting, airdrop, eligibility-check, exchange, and brand-impersonation pages lure visitors into connecting a wallet.
- An embedded JavaScript loader decodes a decimal character-code array and executes it to initialize the drainer.
- The loader races DNS-over-HTTPS queries for a TXT record to discover the current drainer pool, and also requests fallback pool configuration from an API endpoint.
- The drainer requests wallet permissions or signatures and submits captured approvals to its backend, allowing the attacker-side relayer to perform transfers.
- The kit disconnects the WalletConnect session after the flow finishes.
- Defensive Notes
- The article recommends considering blocking access to public DNS-over-HTTPS services and fully monitoring DNS.
- Monitor DNS TXT queries and unexpected direct use of public DoH services, since the kit uses them to locate operational infrastructure.
- The pool can change through a TXT-record update, so blocking only a previously observed pool may not prevent access to replacement infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | noir[.]black | Noir configuration/API infrastructure used to provide fallback pool directions. |
| HOSTNAME | listchoiseopenleaderboardseptember[.]netlify[.]app | Host serving a fake cryptocurrency voting lure page that loaded the Noir drainer. |
| HOSTNAME | render-984[.]pages[.]dev | Drainer pool host returned by the DNS TXT record and used to serve the drainer script. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe lure's JavaScript contains a decimal character-code array that is decoded to construct and execute the loader.T1059.007 · JavaScriptAn embedded JavaScript loader decodes a character-code array and executes it to initialize the drainer.T1071.004 · DNSNoir uses DNS TXT records to obtain its active drainer pool domain and DoH queries to retrieve that configuration.
Threat Actors
Malware
Products
Cloudflare PagesWe found a cryptocurrency wallet-drainer kit, self-branded as Noir, that uses DNS TXT records to locate its hosted pool; currently these run on Cloudflare Pages.WalletConnectOnce the flow finishes, it disconnects the WalletConnect session, so the malicious application no longer remains visible in the wallet’s connected-applications list.