Noir wallet drainer kit hides its backend behind DNS TXT records and DoH
Users of Uniswap, Lido, Hyperliquid, Polymarket and other brands targeted by Noir lure pages
Infoblox Threat Intel described Noir on 9 October 2026, a wallet-drainer kit that looks up its backend pool through DNS TXT records over public DNS-over-HTTPS, so operators can repoint every lure page by changing one record. Lures impersonate CoinMarketCap, DexScreener, OKX, Uniswap, Lido, Hyperliquid, Morpho, Ondo, LayerZero, MegaETH, Polymarket and others with fake votes, airdrop checks and swap clones. It steals by getting token spending permissions, then cuts the WalletConnect session to hide the trail. Infoblox gave no loss figures and says the kit was likely AI-developed.
Why this severity: Still active, many people exposed.
AI involvement
AI-built malware. Infoblox says it seems likely the Noir drainer kit is created and maintained with AI assistance, based on its verbose explanatory code comments, while noting a human could also have written it.
Check that a package, extension or app is the real one before installing it, even when an AI assistant suggested it.
- Started
- Oct 9, 2026
- Chains
- Multiple EVM chains
Indicators · never visit or send to these
- noir[.]black
- _r.noir[.]black
- render-984.pages[.]dev
- listchoiseopenleaderboardseptember.netlify[.]app
What to do now
- Revoke token approvals and Permit2 allowances you do not recognise.
- Disconnect stale WalletConnect sessions and move funds if you approved anything unknown.
Stay safe
Am I affected?
If you connected a wallet to a 'community vote', 'airdrop eligibility check' or swap page reached from a link (not the project's own site) and approved a token permission, you may be affected.
What to do now
- Revoke token approvals and Permit2 allowances you do not recognise.
- Disconnect stale WalletConnect sessions and move funds if you approved anything unknown.
How to avoid this
- Reach dApps by typing the address or using a saved bookmark, not from ads, replies or DMs.
- Be wary of 'Desktop browser required' gates and fake voting pages; real projects rarely need a wallet to vote on a listing.
- Network admins can block public DoH and the listed domains.
Timeline 1
Infoblox Threat Intel publishes its analysis of the Noir drainer kit and its DNS TXT based control channel.
Source
News & write-ups ›1
How this method works
Ready-made drainer software rented to scammers for a cut of the loot. It powers most phishing sites you'll ever see. Read about drainer kits (drainer-as-a-service) →
Follow new drains and updates in your feed reader or Telegram RSS bot.