A criminal business model
Drainer-as-a-service providers rent out ready-made phishing kits and drainer scripts, taking a cut of stolen funds. This lowers the skill needed to run attacks and multiplies the number of phishing sites.
What the kits do
They clone popular dapps, trigger wallet pop-ups, and craft the exact signatures that transfer the most value — unlimited approvals, Permit2 signatures, and setApprovalForAll for NFTs.
How to defend
Since the same drainer scripts appear across thousands of sites, blocklists and behavior detection are effective. Use a browser layer that recognizes known drainer patterns and warns before the malicious signature is signed.