Flap (a modular token launch platform)’s official website flap.sh was hit by a DNS hijacking attack and redirected to a malicious clone site. Attackers gained control at the domain registrar level, pointed DNS to a malicious Dutch server, and deployed the StepDrainer wallet-drainer toolkit. This tricked users who visited and connected wallets into signing malicious transactions (e.g., unlimited approvals) to drain assets. The team warned users not to visit the site, connect wallets, or sign anything, and migrated to the new domain flap.cool.