{
 "slug": "inferno-angelferno-drainer-still-active-oct-2026",
 "title": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
 "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026",
 "json": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026.json",
 "status": "live",
 "severity": "critical",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "multi-evm"
 ],
 "method": "drainer-kit",
 "product": "Web3 users targeted by Inferno/AngelFerno affiliate phishing sites and domain takeovers",
 "tags": [
  "multi-evm",
  "drainer-kit",
  "drainer-as-a-service",
  "inferno-drainer",
  "angel-drainer",
  "angelferno",
  "purple-drainer",
  "permit2",
  "cloudflare-workers",
  "ransom-isac"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-03-01",
 "closedAt": null,
 "updatedAt": "2026-10-05T12:00:00Z",
 "summary": "A Ransom-ISAC report published on 5 October 2026 says the Inferno drainer ecosystem, now branded AngelFerno after merging with Angel Drainer, was still running in summer 2026 with thousands of affiliates. It says AngelFerno announced it had bought Purple Drainer in March 2026, that its factory has deployed over 17,000 single-use drainer contracts, and that it targets 165 tokens on 11 EVM chains (with Solana, TRON, SUI and XRP variants). The report ties it to domain takeovers including CoW Protocol in April 2026 (about $1.2M lost) and notes a May 2026 key rotation that locked the operators out of their own command contract for about 23 days.",
 "timeline": [
  {
   "date": "2026-03-01",
   "title": "AngelFerno announces it has acquired Purple Drainer (month reported; day not given).",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/"
  },
  {
   "date": "2026-04-14",
   "title": "CoW Protocol domain takeover (April 2026; see cow-swap-dns-hijack-apr-2026), which the report links to the Inferno ecosystem, costs users about $1.2M over about 4.5 hours.",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/"
  },
  {
   "date": "2026-05-01",
   "title": "A key rotation locks the operators out of their own command contract for about 23 days (month reported; day not given).",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/"
  },
  {
   "date": "2026-10-05",
   "title": "Ransom-ISAC publishes 'Inferno Drainer Is Burning Out', describing the ecosystem as still active.",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "Inferno Drainer Is Burning Out",
   "url": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "publisher": "Ransom-ISAC",
   "date": "2026-10-05"
  }
 ],
 "indicators": {
  "domains": [
   "apcnoo2[.]su",
   "logs-zone[.]com",
   "openfpcdn[.]io"
  ],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you connected a wallet to a cloned or hijacked dApp site and signed an approval, Permit2 signature, setApprovalForAll or increaseAllowance, an Inferno affiliate may hold spending rights over your tokens.\n\n## What to do now\n- Review and revoke ERC-20, NFT and Permit2 permissions on every chain where that wallet was connected.\n- Move funds to a new wallet if you cannot account for every approval.\n\n## How to avoid this\n- Bookmark the dApps you use; domain takeovers can make a real URL serve a drainer, so read every signature even on familiar sites.\n- Use a wallet or extension that flags known drainer contracts and decodes permits.\n- Network admins can block the drainer's CDN dependency listed below.",
 "notes": null,
 "agentBrief": "# Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March\n\n- Severity: Critical · Status: Still active (live)\n- Chains: Multiple EVM chains · Method: Drainer kits (drainer-as-a-service)\n- Started: Mar 1, 2026 · Last update: Oct 5, 2026\n- Who/what: Web3 users targeted by Inferno/AngelFerno affiliate phishing sites and domain takeovers\n\nA Ransom-ISAC report published on 5 October 2026 says the Inferno drainer ecosystem, now branded AngelFerno after merging with Angel Drainer, was still running in summer 2026 with thousands of affiliates. It says AngelFerno announced it had bought Purple Drainer in March 2026, that its factory has deployed over 17,000 single-use drainer contracts, and that it targets 165 tokens on 11 EVM chains (with Solana, TRON, SUI and XRP variants). The report ties it to domain takeovers including CoW Protocol in April 2026 (about $1.2M lost) and notes a May 2026 key rotation that locked the operators out of their own command contract for about 23 days.\n\n## Am I affected?\nIf you connected a wallet to a cloned or hijacked dApp site and signed an approval, Permit2 signature, setApprovalForAll or increaseAllowance, an Inferno affiliate may hold spending rights over your tokens.\n\n## What to do now\n- Review and revoke ERC-20, NFT and Permit2 permissions on every chain where that wallet was connected.\n- Move funds to a new wallet if you cannot account for every approval.\n\n## How to avoid this\n- Bookmark the dApps you use; domain takeovers can make a real URL serve a drainer, so read every signature even on familiar sites.\n- Use a wallet or extension that flags known drainer contracts and decodes permits.\n- Network admins can block the drainer's CDN dependency listed below.\n\n## Indicators (block these, never visit them)\n- Domain: apcnoo2[.]su\n- Domain: logs-zone[.]com\n- Domain: openfpcdn[.]io\n\n## Sources\n- Inferno Drainer Is Burning Out (Ransom-ISAC, 2026-10-05): https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/\n\nFull record: https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026 · JSON: https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}