FreeDrain Unmasked | Uncovering an Industrial-Scale Crypto Theft Network
Essential information
- Published
- 09/05/2025 15:03
- Modified
- 09/05/2025 16:57
- Tags
- 2025-05-09 cryptocurrency phishing redirection techniques search engine poisoning seo manipulation wallet theft
- Related entities
- 71 observables, 1 intrusion sets (apt), 11 techniques (mitre)
Description
FreeDrain is a sophisticated, large-scale cryptocurrency phishing operation that has been stealing digital assets for years. It exploits search engine optimization, free-tier web services, and layered redirection techniques to target cryptocurrency wallets. Victims are lured through high-ranking search results to phishing pages that mimic legitimate wallet interfaces. The operation has been linked to over 38,000 distinct subdomains hosting lure pages. Evidence suggests the operators are based in the UTC+05:30 timezone, likely in India, working standard weekday hours. The campaign highlights systemic weaknesses in free publishing platforms and the need for stronger safeguards, user education, and security community collaboration to combat such threats.