A new report from anti-scam platform Scam Sniffer says the crypto malware tool MS Wallet Drainer has stolen more than $58 million in digital assets since March. As of December 21, the campaign had impacted over 63,000 victims. The drainer reportedly spreads through phishing links placed in Google search ads and X advertisements, targeting users searching for crypto services.
Fake Ads Built Around Popular Crypto Brands
According to the report, the malware targets wallets on Ethereum, BNB Chain, and other EVM networks and rollups. It is distributed through ads tied to searches for popular crypto and decentralized finance platforms, including Zapper, Lido, Stargate, Defillama, Orbiter Finance, and Radiant. Once users land on a spoofed site and connect their wallets, available tokens and NFTs can be drained rapidly.
Scam Sniffer also found the same malware in a series of Ordinals-related ads on X. In a recent sample of ads shown in some user feeds, the firm said that more than 60% led to websites using MS Drainer. That suggests the operation is not limited to isolated phishing incidents, but is being pushed at scale through mainstream advertising channels.
Evasion Tactics and Underground Sales
The report says the operators use multiple techniques to avoid ad reviews and conceal their intent. These include targeting only certain regions and relying on redirects so the malicious destination is hidden during platform checks. Such tactics make the ads appear compliant on the surface while exposing selected users to phishing pages.
The losses tied to the campaign are substantial. One victim reportedly lost more than $24 million from an Ethereum wallet, while another lost over $1 million in ETH-based assets. Investigators also found that MS Wallet Drainer is being offered on darknet forums for $1,500 as a standard package. Unlike some fully managed drainer services that take a 20% cut of stolen funds, this product appears to charge for add-on modules beyond the base functionality.
The findings highlight how crypto theft operations are increasingly using mainstream ad infrastructure and social platforms to scale attacks. For users, the case is another reminder that sponsored results are not inherently safe, especially when accessing wallet tools, DeFi platforms, or NFT-related services.