Navipay: fake payment-settlement portal that opens a WebDAV share in File Explorer and delivers a shortcut installing the "Fleet Agent" backdoor

Fake "Navipay" back-office settlement portal, relabelled for each target company, showing a monthly statement chart and a PDF preview. Clicking any month sends the browser to a Windows search-ms: link that asks to open File Explorer on the operator's WebDAV share (\\cloud.navipay[.]cfd@80\cloud), filtered so that only a shortcut named Settlement_<Month>.lnk is shown. The shortcut runs an obfuscated cmd.exe command that downloads msct.ocx into C:\ProgramData and registers it with regsvr32. The chain ends in a backdoor that installs itself as the "Fleet Agent" (FleetSvc) Windows service and keeps a WebSocket connection to its server. The page also records every visit, click and right-click together with a browser fingerprint. Copies have run on navipay[.]cfd and on throwaway domains such as sunstonehub-joojebiabokhoreshbaba[.]lat and fastbirdline-elephgoup[.]top. A match means a page carrying the kit or its tracker script, or a scan of one of its known hosts.