A newly discovered social engineering campaign is actively exploiting users on Twitter and Discord social platforms and causing users to lose thousands in cryptocurrency. The campaign is currently attributed to a threat group tracked as Pink Drainer, properly named after the Ethereum Name Service (ENS) seen in the attacks, “pink-drainer[.]eth”. Pink Drainer’s recent campaign revolves around the compromise of legitimate Twitter and Discord accounts and the distribution of malicious website URLs through those compromised accounts. Specific to Discord, threat actors would initially spear phish the account holder, build trust by masking themselves as media journalists, then send a maliciously crafted link with the end result often being theft of the user’s Discord token. By using a legitimate user account to disseminate these malicious links, increased trust is established and leads to an increase in successful social engineering compromises, which in this campaign includes the theft of millions of dollars in various cryptocurrencies. Pink Drainer actors also employ persistence tactics including removing moderators/administrators from applicable servers and escalating user accounts to have Discord administrative rights, allowing for the phishing posts to remain live for an extended amount of time. This campaign has been ongoing for just one (1) month and has already stolen over 3 million dollars in assets from over 1,900 individuals. CTIX continues to urge users to validate the integrity of any digital communications prior to opening any links or downloading any attachments to lessen the risk for threat actor compromise.