{
 "tag": "noir-drainer",
 "name": "Noir Drainer",
 "group": "Drainer kits & crews",
 "incidents": [
  {
   "slug": "noir-drainer-dns-txt-c2-oct-2026",
   "title": "Noir wallet drainer kit hides its backend behind DNS TXT records and DoH",
   "url": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026",
   "json": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Infoblox says it seems likely the Noir drainer kit is created and maintained with AI assistance, based on its verbose explanatory code comments, while noting a human could also have written it."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "drainer-kit",
   "product": "Users of Uniswap, Lido, Hyperliquid, Polymarket and other brands targeted by Noir lure pages",
   "tags": [
    "multi-evm",
    "drainer-kit",
    "drainer-as-a-service",
    "noir-drainer",
    "dns-txt",
    "doh",
    "cloudflare-pages",
    "netlify",
    "walletconnect",
    "fake-airdrop",
    "infoblox",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-09",
   "closedAt": null,
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "Infoblox Threat Intel described Noir on 9 October 2026, a wallet-drainer kit that looks up its backend pool through DNS TXT records over public DNS-over-HTTPS, so operators can repoint every lure page by changing one record. Lures impersonate CoinMarketCap, DexScreener, OKX, Uniswap, Lido, Hyperliquid, Morpho, Ondo, LayerZero, MegaETH, Polymarket and others with fake votes, airdrop checks and swap clones. It steals by getting token spending permissions, then cuts the WalletConnect session to hide the trail. Infoblox gave no loss figures and says the kit was likely AI-developed."
  }
 ],
 "changes": [
  {
   "incident": "noir-drainer-dns-txt-c2-oct-2026",
   "incidentTitle": "Noir wallet drainer kit hides its backend behind DNS TXT records and DoH",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-09",
   "title": "Infoblox Threat Intel publishes its analysis of the Noir drainer kit and its DNS TXT based control channel.",
   "sourceUrl": "https://www.infoblox.com/blog/threat-intelligence/when-a-wallet-drainer-asks-dns-where-to-go/",
   "url": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026"
  }
 ]
}