Worked example · 2024-08

Discord bookmark-phishing drainer campaign via server-boost mechanic — EVM/Solana — 2024-08 to 2024-10

Loss

approximately $2.1 million in aggregate across over 600 identified victims during a ~10-week campaign. The attacker exploited Discord's server-boost and announcement-channel mechanics to anchor phishing links in high-visibility positions within large DeFi and NFT community servers. Individual victim losses ranged from $500 to $85,000, with the median around $3,500.

OAK Techniques observed

OAK-T4.007 (Native-app Social Phishing on Engagement-Weighted Platforms — primary; the distribution surface was Discord's server-boost and announcement-channel mechanics, which the attacker purchased or social-engineered to occupy high-visibility message slots within legitimate community servers) + OAK-T4.001 (Permit2 Signature-Based Authority Misuse — chained extraction; the phishing site solicited Permit2 signatures granting token-spend authority to an attacker-controlled address, with the Permit2 payload disguised as a "server-verification signature" for Discord account linking) + OAK-T4.004 (Allowance/Approve-Pattern Drainer — alternate extraction path where Permit2 was not supported by the victim's token contract; the drainer fell back to standard approve() grants).

Attribution

pseudonymous — the campaign operated through compromised Discord moderator accounts and purchased server-boost subscriptions. The phishing infrastructure rotated domains every 48–72 hours using bulletproof hosting providers. The drainer-kit fingerprint matched the Angel Drainer family. No individual operator has been publicly attributed at v0.1.

Key teaching point

Discord's server-boost mechanic — where boosting a server grants the booster elevated message visibility, custom-role assignment, and announcement-channel posting privileges — creates a paid-for in-platform distribution surface structurally analogous to T4.007's Polymarket comment-pinning pattern. The attacker buys or earns visibility within a legitimate community server through the platform's own mechanics, then occupies that visibility with phishing links that inherit the server's trust context. The campaign demonstrates T4.007's generalisability beyond Polymarket to any platform where engagement-weighted or paid-for mechanics determine content visibility.

Phase 1 (Infiltration)

The attacker purchased Discord Nitro subscriptions and used them to boost target servers — including official Discord servers for major DeFi protocols (Aave, Lido, EigenLayer), NFT projects (Pudgy Penguins, Azuki), and trading communities. Boosting a server grants the booster a "Server Booster" role and, in many server configurations, access to post in announcement channels or pinned-message slots that the attacker used to anchor phishing content. Where server-boost alone was insufficient, the attacker socially engineered moderator accounts through credential-phishing DMs, then used the compromised moderator accounts to post phishing announcements directly.

Phase 2 (Distribution)

From the elevated-visibility position within each target server, the attacker posted "mandatory security verification" or "wallet linking required for airdrop eligibility" messages containing links to phishing domains (e.g., aave-connect[.]com, lido-claim[.]xyz). Because the messages appeared in official server announcement channels — and, in moderator-compromise cases, were posted by the genuine moderator account — users treated them as legitimate server communications. The phishing domains hosted cloned dApp frontends that prompted WalletConnect session establishment or direct signature requests.

Phase 3 (Extraction)

Once a victim connected their wallet and initiated the "verification" flow, the Angel Drainer backend solicited Permit2 signatures granting token-spend authority to an attacker-controlled address. For tokens on contracts that did not support Permit2, the drainer fell back to standard unlimited approve() grants. The signature-request UI displayed a fake "verifying wallet ownership" loading screen while the Permit2 payload was constructed and signed. After extraction, funds were routed through instant-swap services (ChangeNOW, FixedFloat) to obfuscate the trail.