{
 "tag": "fake-airdrop",
 "name": "Fake Airdrop",
 "group": "Other",
 "incidents": [
  {
   "slug": "noir-drainer-dns-txt-c2-oct-2026",
   "title": "Noir wallet drainer kit hides its backend behind DNS TXT records and DoH",
   "url": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026",
   "json": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Infoblox says it seems likely the Noir drainer kit is created and maintained with AI assistance, based on its verbose explanatory code comments, while noting a human could also have written it."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "drainer-kit",
   "product": "Users of Uniswap, Lido, Hyperliquid, Polymarket and other brands targeted by Noir lure pages",
   "tags": [
    "multi-evm",
    "drainer-kit",
    "drainer-as-a-service",
    "noir-drainer",
    "dns-txt",
    "doh",
    "cloudflare-pages",
    "netlify",
    "walletconnect",
    "fake-airdrop",
    "infoblox",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-09",
   "closedAt": null,
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "Infoblox Threat Intel described Noir on 9 October 2026, a wallet-drainer kit that looks up its backend pool through DNS TXT records over public DNS-over-HTTPS, so operators can repoint every lure page by changing one record. Lures impersonate CoinMarketCap, DexScreener, OKX, Uniswap, Lido, Hyperliquid, Morpho, Ondo, LayerZero, MegaETH, Polymarket and others with fake votes, airdrop checks and swap clones. It steals by getting token spending permissions, then cuts the WalletConnect session to hide the trail. Infoblox gave no loss figures and says the kit was likely AI-developed."
  },
  {
   "slug": "arbitrum-dao-x-account-hijack-feb-2026",
   "title": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026",
   "json": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "arbitrum"
   ],
   "method": "fake-airdrop-site",
   "product": "Arbitrum DAO followers on X",
   "tags": [
    "arbitrum",
    "fake-airdrop-site",
    "x-account-hack",
    "fake-airdrop",
    "social-media",
    "phishing"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-03",
   "closedAt": "2026-02-03",
   "updatedAt": "2026-02-03T12:00:00Z",
   "summary": "On 3 February 2026 attackers took over Arbitrum DAO's official governance account on X (@arbitrumdao_gov) and posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com, a lookalike site with a 'Connect Wallet' prompt. Arbitrum told users not to click links from the account and said the protocol and funds were not affected. No losses had been reported at the time."
  }
 ],
 "changes": [
  {
   "incident": "noir-drainer-dns-txt-c2-oct-2026",
   "incidentTitle": "Noir wallet drainer kit hides its backend behind DNS TXT records and DoH",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-09",
   "title": "Infoblox Threat Intel publishes its analysis of the Noir drainer kit and its DNS TXT based control channel.",
   "sourceUrl": "https://www.infoblox.com/blog/threat-intelligence/when-a-wallet-drainer-asks-dns-where-to-go/",
   "url": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026"
  },
  {
   "incident": "arbitrum-dao-x-account-hijack-feb-2026",
   "incidentTitle": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-03",
   "title": "The hijacked @arbitrumdao_gov account posted a fake 'Arbitrum snapshot confirmed' airdrop linking to gov-arbitrum[.]com.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026"
  },
  {
   "incident": "arbitrum-dao-x-account-hijack-feb-2026",
   "incidentTitle": "Hijacked Arbitrum DAO X account posts fake 'snapshot confirmed' airdrop linking to phishing site",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-02-03",
   "title": "Arbitrum warned users not to click links or interact with the account until further notice and said it was working to restore access.",
   "sourceUrl": "https://www.cryptopolitan.com/the-arbitrum-dao-account-has-been-hacked/",
   "url": "https://drains.watch/i/arbitrum-dao-x-account-hijack-feb-2026"
  }
 ]
}