Threats Tagged 'doh abuse'

Noir is a cryptocurrency wallet-drainer malware kit that uses DNS TXT records and DNS-over-HTTPS (DoH) as a dynamic command-and-control mechanism. It queries public DoH services to locate active infrastructure hosted on Cloudflare Pages, enabling operators to redirect phishing lures by changing a single DNS record. The malware does not require victims to input seed phrases or private keys but instead requests wallet connection permissions and spending approvals, which appear less suspicious. Its architecture separates long-lived phishing lures from short-lived operational infrastructure, with DNS caching and retry logic. The kit is AI-assisted, with extensive code comments documenting its development, and is used across multiple cryptocurrency-themed phishing campaigns.