Inferno Drainer phishing-as-a-service campaign hack — November 2023

Inferno Drainer was a phishing-as-a-service kit rented to affiliates who used it to empty cryptocurrency wallets. Victims were led to counterfeit versions of well-known crypto sites — fake airdrop claims, NFT mints and token pages — where they were asked to connect a wallet and sign a transaction or token approval. The signature handed control of the victim's assets to the operator rather than performing the action the page described.

Group-IB found that the kit's customers ran the scheme through more than 16,000 unique domains impersonating upwards of 100 cryptocurrency brands, and that the developers kept 20 percent of each theft, rising to 30 percent in cases where they also built and hosted the phishing site.

The operators announced on 26 November 2023, in their Telegram channel, that the service was closing, saying that Inferno was closed for good and would not return. Group-IB reported that the customer panel was still reachable in January 2024, and kits trading under the name resurfaced later.

Campaign totals differ because they were compiled at different points. Scam Sniffer counted more than $70 million taken from 103,767 victims as of the shutdown announcement, then $81 million from 134,000 victims in its year-end review covering activity since March 2023. Group-IB, working from its own infrastructure analysis, put the figure at more than $80 million across November 2022 to November 2023. The higher figure is recorded as the best estimate because it is the more complete accounting and is independently corroborated by Group-IB's separate research.

No arrests connected to Inferno Drainer have been reported and none of the stolen funds is known to have been recovered.