Tracked hunts and campaigns, each anchored to a script fingerprint, a YARA rule, a search query or a TLS certificate. Every scanned script and page is matched against them automatically.
299 hunts·35 hit in the last 24 hours·59,466 sightings
criticalmacfinger-clickfix-2026-09stealermatches by YARA + queryadded 2026-09-23
Legitimate websites carrying an injected script that loads /t.js?site=<32 hex> from a rotating attacker domain, followed by a content-addressed loader (t.<hash>.js) and a fingerprinting stage (ext-b.<hash>.js). macOS visitors are shown a fake bot-protection page with ClickFix instructions to paste a Terminal command, which downloads a bash stager and an Atomic macOS Stealer (AMOS) variant. The attacker domain changes roughly daily, each on its own IP address, so this hunt follows the loader content and the public Emerging Threats signatures for the campaign rather than any single domain.
criticalmacfinger-clickfix-2026-09stealermatches by YARAadded 2026-10-01
The first-stage script that compromised websites load from a rotating attacker domain as /t.js?site=<32 hex>. Its content differs for every victim site, so it is matched by structure: the analytics and A/B-test globals it sets, together with its references to the content-addressed loader t.<hash>.js and the ext-b fingerprinting stage.
criticalmacfinger-clickfix-2026-09stealermatches by scriptadded 2026-09-23
Byte-identical copies of the Macfinger ClickFix loader script t.4b1009ff6c3f.js, served from every attacker domain in the rotation. The file name is the first twelve hex characters of the file's SHA-256.
criticalexvicy-errtraffic-2026-09phishingmatches by queryadded 2026-09-23
Pages that requested one of the domains published for Exvicy, a ClickFix framework rented out on a Russian-speaking forum since May 2026 and built on reused ErrTraffic code. A script injected into a hacked WordPress site opens a full-screen "Security Check" iframe from these hosts, showing a fake Cloudflare Turnstile challenge that tells the visitor to press Win+R and paste a PowerShell command.
highmeta-page-appealphishingmatches by scriptadded 2026-07-07
Facebook/Meta 'Business — Page Appeal' credential-phishing campaign on disposable hosting (pages.dev/vercel/netlify/workers). The kit cloaks scanners three ways — redirecting datacenter IPs to real facebook.com, serving them a blank decoy shell, or showing the lure directly — while residential clients always get the Meta-branded appeal lure. This entry tracks one build of the kit's React bundle.
criticalbluemoon-shadowpad-2026-09othermatches by queryadded 2026-09-12
A scan whose entry or final URL is on the actor's own C2 / payload-staging infrastructure, or that resolves to 79.133.56.90. Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09).
criticalclearfake-enterprise26-2026-08phishingmatches by queryadded 2026-09-25
Compromised WordPress sites read a BNB Smart Chain testnet contract (EtherHiding) that returns a loader for a second-stage script on a look-alike 'cloud enterprise' domain (e.g. cloudsenterprise2026.com/js/my?<8 chars>&ts=<ms>) or a fake CDN host (cdn.claritydelivr.com, cdn.quickdelivr.com, cdn.nodedelivr.com). Later waves route through the traffic-distribution hosts mytds1029380.com and teamftds00.com. The second stage is VM-obfuscated JavaScript that shows a fake verification lure and stages a PowerShell command for the visitor to paste; publicly reported follow-on activity is a .NET RAT compiled at runtime and injected into svchost.exe. Lure domains cloak to cloudflare.com for scanners.
criticalflowerstorm-phaas-2026-10phishingmatches by YARA + queryadded 2026-10-13
Phishing-as-a-service kit (publicly known as FlowerStorm) that imitates the Microsoft 365, Outlook/Hotmail and GoDaddy sign-in pages, relays the password to the real service and walks the victim through their registered MFA methods (authenticator push, one-time code, SMS, voice call) to take over the session. The lure is usually a copy of an email attachment hosted on public object storage (Cloudflare R2 public buckets) or on a compromised website, sometimes smuggled into the browser as a blob: page. It decodes a small loader that pulls common JavaScript libraries from public CDNs and then the kit itself, named bootstrap.min.js, from the root of a Tencent Cloud object-storage bucket, handing it the victim's email address from the link. The outer wrapper changes (an escaped eval, a CryptoJS AES envelope, or the KrakVM JavaScript virtual machine described publicly in May 2026); the loader and the kit underneath stay the same. Seen since at least July 2026.
criticalwhatsapp-linked-device-seo-2026-10phishingmatches by YARA + queryadded 2026-10-21
Fake WhatsApp Web login pages in Traditional Chinese that show a live QR code or ask for a phone number, so that scanning the code or entering the pairing code links the victim's WhatsApp account to a device the attacker controls. The phishing pages are reached only from search results. A large set of look-alike doorway domains registered in bulk in October 2026, such as webapi-whatsapp[.]com, webhwsapp-whatsapp[.]com and aggregator-whatsapp[.]com, shows search engines an article about WhatsApp Web, sends a visitor arriving from a search result on to a phishing page, and sends anyone else to a search engine or to WhatsApp's real site, so a direct visit shows nothing of the lure. Phishing hosts seen include web.boot-whatsapp[.]com, web.poly-whatsapp[.]com, docss-whatsapp[.]com and gm-whatsappt[.]com. The doorways use the same cloak script as the same operator's fake Google Chrome and WPS Office download sites. A match means a page carrying one of the phishing kit builds or the operator's visit tracker, or a scan of a known doorway server address or campaign host.
criticallhdn-tax-notice-autodownload-kit-2026-10phishingmatches by YARA + queryadded 2026-10-26
Emails posing as Malaysia's Inland Revenue Board (LHDN) send a 'tax claim and penalty notice' whose button leads to a throwaway site. The site shows an empty page and immediately downloads a ZIP or RAR archive named like a tax document or PDF (TAX100_PDF102.zip, PDF1024701.zip, TAX20123710_126.zip). Inside is a disk image holding a signed program and a hidden DLL that the program loads (DLL side-loading), or the installer of a remote-management agent already pointed at the operator's server. The domains are expired names that were bought back and switched to the kit on the day they are used, several new ones a day, among them homescapestaging[.]com, celialinde[.]com, segertribute[.]com, crackdie[.]com, nexmoke[.]com, laifapk[.]com and goezbar[.]com. The same servers also carried an Indian 'challan notice' page that sent visitors to a fake PowerISO download. A match means a page that silently downloads an archive in this kit's way, or a scan of a host on the operator's servers.
criticaltech-support-browser-locker-2026-10othermatches by YARA + queryadded 2026-10-17
Pages that show a fake Microsoft, Windows Defender or Apple security alert (a blocked or infected computer, an error code, a warning sound), switch the browser to full screen, capture the keyboard and block leaving the page so the visitor cannot close it, and tell the visitor to call a 'support' phone number. The call is the scam: the caller is talked into paying for fake repairs or into installing remote-access software. One campaign places the alert on random subdomains of Azure Storage static websites (*.web.core.windows.net) and passes the phone number in the address (?phone=...), in English ('WIndows Err') and Japanese ('読み込みエラー') versions; its lure addresses are matched even after a site has been taken down. No genuine security warning locks the browser or asks you to phone a number.
highmeta-page-appealphishingmatches by scriptadded 2026-07-07
Facebook/Meta 'Business — Page Appeal' credential-phishing campaign on disposable hosting (pages.dev/vercel/netlify/workers). The kit cloaks scanners three ways — redirecting datacenter IPs to real facebook.com, serving them a blank decoy shell, or showing the lure directly — while residential clients always get the Meta-branded appeal lure. This entry tracks one build of the kit's React bundle.
criticalcloudflare_workers_phishingphishingmatches by queryadded 2026-06-30
High-risk phishing kits hosted on Cloudflare Workers (*.workers.dev) — disposable gibberish-subdomain hosts impersonating brands (Adobe / Microsoft / DocuSign / GitHub / banks). Includes form-less device-code / OAuth-consent (EvilToken-style) kits that lure victims into authorising a Microsoft device code on the real identity provider, plus credential-harvest clones. Tracked by device-code phishing signals (a device-code screen or grant flow, a 'devicelogin' lure in the page text, *-s-account.workers.dev hosts), so it follows the family rather than individual sites.
criticalagtabackup-meeting-update-rmm-2026-10phishingmatches by YARA + queryadded 2026-10-21
Fake meeting and document pages run by the operator behind the AgtaBackup remote-access trojan. A copy of Google Meet blurs the meeting screen behind an "Update Google Meet" prompt; a Zoom "Join Meeting" page counts down and starts a download by itself; a Google Drive "scan warning" page offers a batch file presented as a PDF. Every download is a remote-management agent enrolled to the operator, such as a rebranded "Ops RMM" agent installed as "Google Meet" and hidden from the installed-programs list, TraceRMM, or a self-hosted ScreenConnect client. It gives the operator hands-on control of the computer, and the same operator's servers run the AgtaBackup RAT panel. The Meet and Drive pages report each visit and each download click to the operator through a tracker script, and a guard script disables the download button for automated browsers. Pages have run on domains such as 224meetgooglecomfskqcdzfcwh[.]com, get-googlemeet[.]com and us06webzoomus2fj2f830440905293[.]com, with payloads on random-name Netlify sites and a GitHub repository. A match means a page carrying the kit's tracker or guard, or a scan that touches one of its known lure, payload or server hosts, or the RAT panel.
criticalphantompolia-sepolia-2026-10stealermatches by YARA + queryadded 2026-10-13
Script injected into compromised websites. It loads the ethers.js library, reads an encrypted value from a smart contract on the Ethereum Sepolia test network through public RPC nodes (EtherHiding: getText()), decrypts it into a host name (PBKDF2 and AES-GCM) and loads the next script from that host. The operator can change the host on-chain. The loader comes in two forms: a plain one dressed up as a tag-manager snippet, and one wrapped with javascript-obfuscator. On online shops the next stage is a card skimmer: it is XOR-encrypted with a key derived from the infected shop's own host name, so it only runs there, and it adds a fake card form styled for the shop's own payment method (card number, expiry, CVV) and sends what is typed to the operator. Each shop has its own contract, password and script path. On other sites the next stage is a ClickFix lure: a fake Cloudflare "verify you are human" check in several languages, with Win+R, Win+X and macOS Terminal steps. It asks the operator's server whether to show itself and which command to copy, so only the visitors the operator selects (by operating system) see it. The copied PowerShell command downloads update.ps1, which installs the Remus infostealer (AutoIt loader, Donut shellcode). Several ClickFix sites share one contract. Seen on small WordPress and WooCommerce sites since at least July 2026; the contracts go back to March 2026. The ClickFix side is described publicly as PhantomPolia.
criticaltopcayxanh-google-signin-operator-2026-10phishingmatches by YARA + queryadded 2026-10-24
An operator of fake Google sign-in pages that take the email address, password and two-step verification code, send them to the operator's own server and then pass the victim on to the real Google account page. The sign-in pages sit behind a Cloudflare interactive check, and the operator fronts them with a copy of a real digital agency's website that invites the visitor to book and join a call. The same operator holds dozens of look-alike domains registered since April 2026 (Google, TikTok, CapCut, Shopify and Telegram look-alikes), among them cmail-geogle[.]com, gooqleinc[.]com, qooqleinc[.]com, goooqle-buissiness[.]com, ads-account[.]com, install-tiktok[.]com, brandogdigital[.]org and brandog[.]digital. A match means a page served by the operator's server (its default site, its tracker panel or its agency copy) or a scan of one of its known hosts.
criticaluac0277-lunexstealer-2026-10stealermatches by YARA + queryadded 2026-10-07
UAC-0277: script injected into compromised, mostly Ukrainian, websites. The current version reads a traffic-distribution (TDS) domain and an on/off mode from a Polygon smart contract (EtherHiding: eth_call to getConfig() through public RPC nodes) and, when switched on, shows Windows visitors who arrive from a search engine a fake Cloudflare check that asks for Win+R, Ctrl+V and Enter. The pasted command runs msiexec against a remote MSI that installs the LunexStealer infostealer, which can add a malicious browser extension posing as 'Microsoft Office Word Editor'. An earlier version of the injection (seen from August 2026) is a short stub that builds a deferred script from character codes and base64-decodes its source to <tds-host>/tds/tracker.js or /tds/new.js.
highms-auth-subdomain-labelphishingmatches by queryadded 2026-08-10
Forward-looking tripwire for the naming convention the Payroll Pirates AiTM proxies used, rather than for the burned domains themselves. Arctic Wolf observed the proxy tier consistently fronted by a Microsoft-themed leftmost label — mslogin., msonline., msauth. — on a freshly registered, otherwise meaningless apex, with the redirector tier one step back on an idp. label. This anchor catches the next rotation of that convention rather than the last one, which matters here because the published domains were all under ten days old when used and are all now suspended.
highcredential-phishing-kits-202607phishingmatches by queryadded 2026-07-02
Five credential-phishing hosts confirmed in July 2026: webmail/Poczta login clones on throwaway hosting (hfmthsga.vercel.app, pljnsad.vercel.app, mid-scarlet-rqxuosjc.edgeone.dev, pub-<hash>.r2.dev), plus meritking2542.com (MeritKing casino brand abuse). All render a password form whose action self-POSTs, uses javascript:, or posts to a blob with the target email embedded.
highdoc-access-email-gate-2026-09phishingmatches by YARAadded 2026-09-28
Pages styled as Microsoft that say 'Document Access Required' and ask the visitor to verify their identity before viewing a shared document. The page shows a fake device panel (browser and version, operating system, the visitor's time-zone city, 'Access Level: Standard User') and a 'Verify Your Email' box, and it also reads the victim's address straight from the link it was sent in, including addresses hidden in base64 or hex. After a fake 'Verifying access permissions' progress bar it forwards the address to a second site that imitates a Microsoft or webmail sign-in page to steal the password. Other versions titled 'Verification Required' or 'Installation Required' download a remote-access tool installer (ScreenConnect) presented as the document viewer, which gives the attacker control of the computer. The pages sit on short-lived two-letter subdomains of randomly named domains (e.g. bx.wsapbfy[.]net, yt.qbipchi[.]com, mirvok[.]vu) and on compromised or free-hosted websites, seen since at least early September 2026. Microsoft does not put shared documents behind such pages; genuine shared files open on sharepoint.com or onedrive.live.com after the normal Microsoft sign-in.
criticalgdrive-turnstile-signin-relay-2026-10phishingmatches by YARA + queryadded 2026-10-21
A fake Google Drive "Document shared with you" page asks the visitor to pass a Cloudflare Turnstile check before signing in to view the file. Past the check, a copy of the Google sign-in page passes the email address and password on to the operator while the victim types, so the operator can sign in to the real account during the same visit. Links are prepared per recipient: the email address is carried in the link, filled in and submitted automatically. The kit has run on pdfdocusignersdocument[.]info. A match means a page carrying the kit's gate or its sign-in pages, or a scan of one of its known hosts.
criticalcn-fake-software-seo-2026-10phishingmatches by YARA + queryadded 2026-10-18
Chinese-language look-alike download sites for Google Chrome, WPS Office, the QuickQ VPN client and Sunlogin remote desktop, active since at least June 2026, on typosquat .cn and .com.cn domains such as chroromee-google[.]com[.]cn, wwps-wps-office[.]cn, quickqick[.]com[.]cn and anydesksk[.]com. Doorway sites such as chromee-google[.]com, chromeer-google[.]com[.]cn and pcchrome-google[.]com[.]cn carry a search-engine cloak: search-engine crawlers see the page, a visitor arriving from a search result is sent on to the fake download site, and anyone else is sent to a search engine, so a direct visit shows nothing of the lure. Every site is generated separately, but each lure family reuses the operator's own page template. Most download buttons were empty when seen; the fake Sunlogin site linked installer archives on third-party hosting. A match means a page carrying the operator's page templates or the cloak script, or a scan of a known campaign host or server address.
criticalclickfix-keyboard-mouse-panel-2026-10phishingmatches by YARA + queryadded 2026-10-21
Fake Microsoft verification pages ('Verify Your Keyboard and Mouse') that walk the visitor through copying a 'unique verification code', then pressing Windows key + X, I to open Terminal, Ctrl+V and Enter. The code shown on screen is a decoy: the copy button puts a different value on the clipboard, which the operator sets from an admin panel and can change at any time, and the page reports every visitor and copy back to the operator and waits for them to approve the visitor. The kit is a self-hosted single-page app that ships the lure, the admin panel, the visitor tracker and a server deploy wizard in one script. Seen since 2026-10-15 on one server (91.92.242[.]215) that answers with the kit for every hostname pointed at it, including microsoftcloudverification[.]com, atocha-cloud[.]com, xapix[.]one, web-site[.]live and api-xdark[.]com. No legitimate verification step asks visitors to run anything.
highnz-download-php-wps-sideload-2026-10phishingmatches by queryadded 2026-10-21
Malware delivery aimed at businesses that sell online. The email poses as a customer whose order arrived damaged and asks the recipient to review an 'unboxing video' or 'damage report'. It is sent through a legitimate no-code app platform, so it passes sender authentication, and its link is a share.google short link (once goo[.]su) that redirects to a file host such as get[.]passionit[.]co[.]nz, conntent[.]s4solar[.]co[.]nz, storage[.]westtec[.]co[.]nz or content[.]ambienti[.]co[.]nz. Every host serves the file from the same path, /download.php/<Lure_Name>_mp4?f=<token>, with lure names in English, French and Italian (Condition_Assessment_Report_mp4, Video_Du_Colis_Recu_Endommage_mp4, Verifica_Documentazione_Aziendale_2026). The hosts are old New Zealand business domains that lapsed and were re-registered, and newly registered look-alikes of them, all behind Cloudflare. The download is a ZIP of about 140 MB: a genuine, signed WPS Office program renamed to look like a video, which loads a hidden DLL of about 120 MB (krpt.dll) from the same folder, and a hidden folder of junk decoy files. The DLL is rebuilt between downloads, so its hash changes. Visitors on other systems get a 'Windows only' page. Seen since 2026-08-27.
criticalromulus-clickfix-delivery-2026-10phishingmatches by YARA + queryadded 2026-10-15
ROMULUS is a web panel that delivers the payloads behind ClickFix lures. A fake verification page (seen on a Google Sites page linked from a malicious ChatGPT Custom GPT, and on compromised small-business websites) tells the visitor to open the Windows Run box and paste a command it has copied to the clipboard. The command fetches a PowerShell stager from a ROMULUS server, addressed as a decimal number instead of a dotted IP so that the pasted text contains no recognisable address. The stager downloads a trojanised MSI installer from /app/<12 hex>/<name>.msi and runs it silently; the installer side-loads a DLL into a legitimately signed program, and other routes deliver LegionLoader. The lure pages use an off-the-shelf fake-verification overlay kit; the most recent one hides the copied command as an index list into a scrambled alphabet that cmd.exe rebuilds with delayed expansion, so the command line itself names no PowerShell, URL or IP. This hunt matches the ROMULUS panel's login page by its page code and lure pages that carry the index-cipher command, and tracks the known panel servers and the lure loader hosts. A second route reaches the same panels through ads: a visitor who lands on a parked look-alike domain is sent by an ad through short-lived game-themed .cfd domains to a fake Cloudflare check, which asks them to open cmd and paste a command that downloads an MSI from a ROMULUS server with curl and installs it silently with msiexec. The server rebuilds that MSI for every download, so its file hash never repeats.
