Operators and affiliates of cryptocurrency drainers have shifted to using high-reputation domains for illicit activity, while re-registering domains that were legitimate and using sophisticated fingerprinting in a bid to better evade detection, reports Cybernews.
Despite the continued prevalence of brute-force intrusions among less knowledgeable attackers, others have sought to exploit compromised accounts for direct malvertising campaigns that could be targeted at certain regions instead of through proprietary Google Ads accounts, a report from the Security Alliance showed.
Most prolific of all crypto draining operations was Inferno Drainer, which has employed a renamed secureproxy in some deployments to avert fingerprint-based analysis. Meanwhile, the nascent Eleven Drainer was discovered to have touted a sports car giveaway for its leading affiliate.
"This indicates that the drainer operators and affiliates are continuously refining their techniques to evade automation, and that further investigation is required," said SEAL researchers.
![{“remix_data”:[],”remix_entry_point”:”challenges”,”source_tags”:[“local”],”origin”:”unknown”,”total_draw_time”:0,”total_draw_actions”:0,”layers_used”:0,”brushes_used”:0,”photos_added”:0,”total_editor_...](/api/thumbor-proxy?width=1920&src=https%3A%2F%2Ffiles.cyberriskalliance.com%2Fwp-content%2Fuploads%2F2026%2F10%2FAdobeStock_2200439738-scaled.jpeg)
