0xCERT-2026-0140: Phishing campaign abusing legitimate ENS subdomains

Coordinated phishing campaign using purchased ENS subdomains pointing to drainer kits. Domain list distributed to wallet vendors.