A large-scale cryptocurrency phishing campaign dubbed FreeDrain has been uncovered, involving over 38,000 fake subdomains that mimic crypto wallet interfaces. The attackers use SEO manipulation and free-tier web services like GitHub Pages and Webflow to lure users searching for wallet-related queries, redirecting them to phishing sites that steal seed phrases. Evidence points to a group operating during Indian Standard Time business hours.
Source: https://thehackernews.com/2025/05/38000-freedrain-subdomains-found.html