Noir wallet-drainer kit pivots through noir.black DNS TXT C2
Infoblox Threat Intel detailed Noir, a crypto wallet-drainer kit that looks up its current infrastructure through DNS TXT records at _r.noir.black and steals through wallet approvals rather than seed phrases.
- First reported
- Reports
- 1
Source: soctember.com · published
What happened
SOCtember reported on October 13, 2026 on Infoblox Threat Intel research, published October 9, into Noir, a cryptocurrency wallet-drainer kit. Infoblox found it while investigating a fake crypto voting page.
Before the drain begins, the kit's loader queries three public DNS-over-HTTPS services (Google Public DNS and two Cloudflare endpoints) for a TXT record at _r.noir.black, which names the Cloudflare Pages pool currently in use. A request to noir.black can return a fallback pool. Observed hostnames include render-984.pages.dev and a lure at listchoiseopenleaderboardseptember.netlify.app.
How the scam works
Victims land on a lure page: fake community votes, airdrops, eligibility checks, clones of crypto exchanges, or brand spoofs. Noir does not ask for a seed phrase or password. After a normal wallet connection shares the public address, it requests a drain plan tailored to that wallet, then asks for spending permissions or typed-data signatures that look less alarming than an explicit transfer.
Captured approvals are used immediately. When the flow ends, the kit disconnects the WalletConnect session so the malicious app no longer appears in the wallet's connected-apps list.
Because the pool is chosen by a DNS answer, operators can switch infrastructure by changing one record. Infoblox says shared infrastructure and lure themes point to a shared service rather than one actor. The research did not publish victim numbers or loss totals.
Source
SOCtember, "Infoblox Tracks Noir Wallet Drainer Using DNS TXT and DoH as a Live C2 Control Plane" (October 13, 2026).
Red flags
- Crypto "vote", airdrop or eligibility pages hosted on pages.dev or netlify.app subdomains.
- Signature or permit requests that do not clearly say what they authorise.
- An app disappearing from your wallet's connected-apps list right after you sign.
If you were targeted
- 1Do not connect a wallet to, or sign anything on, the listed site.
- 2If you already approved a transaction there, revoke token approvals using a reputable approval-checker for your wallet's network, and move remaining funds to a new wallet if you are unsure what you signed.
- 3If you entered a recovery phrase anywhere, treat that wallet as compromised: create a new wallet with a new phrase and move any remaining assets.
- 4Report the site to your wallet provider and to the FBI at ic3.gov (or your national cybercrime agency).
- 5Security teams: monitor TXT queries for _r.noir.black, block noir.black and observed pool hosts, and treat unexpected browser DNS-over-HTTPS to public resolvers as a hunting lead.