DNS as C2 in Noir, An AI-Developed Crypto Wallet Drainer

Noir is a cryptocurrency wallet-drainer kit that leverages DNS TXT records and DNS-over-HTTPS (DoH) for its command-and-control (C2) communications. The loader dynamically discovers active infrastructure hosted on Cloudflare Pages by querying public DoH services, allowing operators to redirect deployed phishing lures by modifying a single DNS record. Unlike traditional wallet drainers that require seed phrases or private keys, Noir requests wallet connection permissions and spending approvals, which are less likely to raise suspicion. The malware architecture separates long-lived phishing lures from short-lived operational infrastructure, employing 60-second DNS caching and self-healing retry logic. The codebase includes extensive plain-English comments suggesting AI-assisted development, documenting bugs, fixes, and design decisions. Noir operates as a shared service across multiple cryptocurrency-themed phishing campaigns, abusing DNS and DoH to evade detection and maintain flexible control.

The malware enables attackers to drain cryptocurrency wallets by obtaining wallet connection permissions and spending approvals without requiring seed phrases or private keys, potentially leading to unauthorized fund transfers. Its use of DNS TXT records and DoH for command-and-control makes detection and disruption more challenging. The dynamic infrastructure hosted on Cloudflare Pages allows rapid redirection of phishing lures, increasing the effectiveness and persistence of campaigns. The separation of phishing lures from operational infrastructure and the use of caching and retry logic enhance the malware's resilience and stealth.

No official patches or fixes are applicable as this is malware rather than a software vulnerability. Defenders should focus on user education to recognize phishing attempts requesting wallet permissions, implement strict wallet permission policies, and monitor for suspicious DNS and DoH traffic patterns. Blocking known malicious domains such as 'noir.black' and 'r.noir.black' can help reduce exposure. Since the malware abuses DNS and DoH, network-level controls and DNS filtering may mitigate command-and-control communications. No vendor advisory or official remediation guidance is available; patch status is not applicable.