Wallet drainer dApp → setApprovalForAll → instant theft

§ Context

Assumed environment: target user has a hot wallet (MetaMask / Phantom) holding NFTs or ERC-20 tokens. Phishing dApp delivered via Discord / Twitter / Google ads.

§ Steps

1. 01
   Sweep NFTs + tokens via approvalExfiltration

   T1041— Exfiltration Over C2 Channel
2. 02
   Victim connects walletExecution

   T1204— User Execution
3. 03
   Promote via Discord / Twitter / adsInitial Access

   PH-OPEN-REDIRECT-CHAIN— Open Redirect Chain for Phishing
4. 04
   Spin up phishing dApp (Inferno / Pink / Angel kit)Resource Development

   T1583— Acquire Infrastructure
5. 05
   Tumble proceeds through mixer / bridgeImpact

   W3-BRIDGE-EXPLOIT— Cross-Chain Bridge Exploit
6. 06
   Trick into setApprovalForAll signatureImpact

   WLT-DRAINER— Wallet Drainer dApp

§ References

• T1041Exfiltration Over C2 Channel
• T1204User Execution
• T1583Acquire Infrastructure

§ Frequently asked

What is the "Wallet drainer dApp → setApprovalForAll → instant theft" attack path?

Victim connects their wallet to a phishing dApp (fake mint / fake airdrop). One click on 'Confirm' calls setApprovalForAll on every valuable NFT collection — drained moments later. It chains 6 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Sweep NFTs + tokens via approval (T1041) — a exfiltration primitive. Assumed environment: target user has a hot wallet (MetaMask / Phantom) holding NFTs or ERC-20 tokens.

What is the final impact of this kill-chain?

The final step lands on Trick into setApprovalForAll signature (WLT-DRAINER), which falls under Impact. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques2

  Malicious MCP server → silent supply chain for agent tools

  User installs an MCP server marketed as a useful integration. Every subsequent agent session has the rogue server in scope — its tools log prompts, exfil files, or inject responses to bias the agent.

• Shared techniques2

  Stolen credentials → no-MFA Snowflake → mass tenant exfil (2024)

  Infostealer logs from third-party machines yielded credentials for many Snowflake tenants. Tenants without enforced MFA / IP allow-lists were directly queried; dozens of customer data sets exfiltrated.

• Shared techniques2

  Mass SMS phish → Okta-style portal → SaaS sprawl (0ktapus)

  Wide SMS phishing campaign targeting employees of ~130 organisations with a single phishlet that captures Okta credentials + push approval. Mass automated logins to Twilio, MailChimp, DoorDash et al.

• Shared techniques2

  Hardware wallet supply-chain tamper → pre-seeded seed

  Intercept Trezor / Ledger / KeepKey in transit (or counterfeit on Amazon / eBay). Replace device with one that already has a known seed phrase the attacker controls — victim deposits, attacker drains.

• Shared techniques2

  Cross-chain bridge validator-set bypass → mint wrapped tokens

  Bridge's signature-set check is off-by-one (Nomad-class) or accepts a zero address (Ronin-class). Mint wrapped tokens on the destination chain without locking on the source.

• Shared techniques2

  Malicious browser extension → cookie harvest → ATO

  Publish a useful-looking extension (ad-blocker / PDF reader). It quietly reads cookies + localStorage from sensitive sites and ships them to the attacker.