Angel Drainer Threats: A Deep Dive into Crypto Phishing Scams

Angel Drainer is a notorious crypto phishing toolkit targeting Web3 users, draining wallets through malicious smart contracts. PhishDestroy has tracked 4,385 domains associated with this threat, with 431 currently active as of our latest scans. This critical threat exploits trust in popular platforms, often using domains mimicking legitimate services like OpenSea or Vercel.

Angel Drainer is a sophisticated phishing-as-a-service (PhaaS) toolkit that emerged in late 2022, primarily targeting cryptocurrency users. It leverages malicious JavaScript embedded in phishing websites to interact with victims’ wallets. The core mechanism involves tricking users into signing transactions that call functions like 'approve()' or 'transferFrom()' on ERC-20 tokens or NFTs, granting attackers full control over assets. These scripts are often obfuscated to evade detection by antivirus software or browser security extensions. Infrastructure-wise, attackers rely on cheap or compromised domain registrars—PhishDestroy data shows NICENIC INTERNATIONAL GROUP CO., LIMITED (1,173 domains) and Cloudflare, Inc. (434 domains) as top choices for hosting these threats. Common TLDs include .com (1,212 domains), .xyz (712), and .app (290), often paired with free hosting on platforms like Vercel, as seen in examples like mysteryclaims6345-live.vercel.app.



The toolkit also employs advanced evasion techniques, such as IP-based redirects to show benign content to bots or security researchers while serving malicious payloads to real users. Angel Drainer campaigns frequently clone legitimate Web3 interfaces, using typosquatting or subdomain tricks (e.g., opensea.com.offer-proposal.com) to deceive users. On the blockchain side, stolen assets are often routed through intermediary wallets before being mixed, with on-chain analysis revealing connections to known money laundering services. This combination of social engineering and technical exploitation makes Angel Drainer a persistent and evolving threat in the Web3 ecosystem.



Additionally, attackers customize their campaigns based on trending topics in the crypto space, such as new token launches or NFT drops, to maximize victim engagement. The use of decentralized hosting and domain privacy services further complicates takedown efforts, as seen with the 431 active domains still operational in PhishDestroy’s database. This infrastructure resilience, paired with the toolkit’s low barrier to entry for cybercriminals, underscores why Angel Drainer remains a critical risk.

Real Cases

Since Jul 2025 2,738 domini con VT ≥ 5

« Precedente 4 5 6 7 8 9 10 Avanti » Pagina 7 di 45