Threat Hunting

Tracked hunts and campaigns, each anchored to a script fingerprint, a YARA rule, a search query or a TLS certificate. Every scanned script and page is matched against them automatically.

299 hunts·35 hit in the last 24 hours·59,466 sightings

Add hunt

Last hit, across 299 hunts

SortGroup by family

Severity

Showing 61–90 of 299 hunts · sorted by last hit

Bank "help desk" look-alike domains behind an operator-approval gate
criticalbank-helpdesk-operator-gate-2026-10phishingmatches by YARA + queryadded 2026-10-13
Phishing campaign, active since at least February 2026, that registers look-alike support domains for banks and business-banking portals: the bank or portal name followed by helpdesk, helpchat, gethelp, getsupport, livesupport, supportchat or supportdesk, for example hsbcnethelpdesk[.]com, cashprolivehelpdesk[.]com or jpmorganaccesshelpchat[.]com. Names seen so far imitate J.P. Morgan Access, Chase Connect, Bank of America CashPro, HSBCnet, Barclays iPortal, Westpac, ANZ, ASB, NAB Connect, CommBank CommBiz, Santander, Wells Fargo, Truist, Airwallex and MUFG, among others. The sites are built to be opened while someone talks the victim through it. An automated visitor gets a plain "Scheduled Maintenance" page. A browser gets a Cloudflare Turnstile check and then a "Verifying Your Session" screen that records the visitor's public IP address (through a WebRTC STUN request) and waits until a human operator approves or rejects the session; only an approved visitor is sent on, and a rejected one is sent to Google. A second variant on the same campaign's domains runs a proof-of-work check and then a page runtime that displays whatever page the operator pushes to it over a WebSocket. Domains are registered a few at a time and are short-lived; many were suspended within days. A match means a page carrying either gate, or a scan of a known campaign server or domain.
sightings
46
hosts
31
last hit
6 days ago
ClearFake — rival-kit cleanup script on compromised sites (YARA)
highclearfake-polygon-loader-2026-10phishingmatches by YARAadded 2026-10-01
Script injected beside the ClearFake Polygon loader. It removes other ClickFix kits' scripts, overlays and stored state from the page, keeps its own overlay on screen, and blocks navigation for up to 45 seconds while that overlay is shown.
sightings
289
hosts
286
last hit
7 days ago
Microsoft-styled 'Document Access Required' email gate — page title
highdoc-access-email-gate-2026-09phishingmatches by queryadded 2026-09-28
Pages styled as Microsoft that say 'Document Access Required' and ask the visitor to verify their identity before viewing a shared document. The page shows a fake device panel (browser and version, operating system, the visitor's time-zone city, 'Access Level: Standard User') and a 'Verify Your Email' box, and it also reads the victim's address straight from the link it was sent in, including addresses hidden in base64 or hex. After a fake 'Verifying access permissions' progress bar it forwards the address to a second site that imitates a Microsoft or webmail sign-in page to steal the password. Other versions titled 'Verification Required' or 'Installation Required' download a remote-access tool installer (ScreenConnect) presented as the document viewer, which gives the attacker control of the computer. The pages sit on short-lived two-letter subdomains of randomly named domains (e.g. bx.wsapbfy[.]net, yt.qbipchi[.]com, mirvok[.]vu) and on compromised or free-hosted websites, seen since at least early September 2026. Microsoft does not put shared documents behind such pages; genuine shared files open on sharepoint.com or onedrive.live.com after the normal Microsoft sign-in.
sightings
6
hosts
1
last hit
7 days ago
Navipay: fake payment-settlement portal that opens a WebDAV share in File Explorer and delivers a shortcut installing the "Fleet Agent" backdoor
criticalnavipay-settlement-searchms-lnk-2026-10phishingmatches by YARA + queryadded 2026-10-20
Fake "Navipay" back-office settlement portal, relabelled for each target company, showing a monthly statement chart and a PDF preview. Clicking any month sends the browser to a Windows search-ms: link that asks to open File Explorer on the operator's WebDAV share (\\cloud.navipay[.]cfd@80\cloud), filtered so that only a shortcut named Settlement_<Month>.lnk is shown. The shortcut runs an obfuscated cmd.exe command that downloads msct.ocx into C:\ProgramData and registers it with regsvr32. The chain ends in a backdoor that installs itself as the "Fleet Agent" (FleetSvc) Windows service and keeps a WebSocket connection to its server. The page also records every visit, click and right-click together with a browser fingerprint. Copies have run on navipay[.]cfd and on throwaway domains such as sunstonehub-joojebiabokhoreshbaba[.]lat and fastbirdline-elephgoup[.]top. A match means a page carrying the kit or its tracker script, or a scan of one of its known hosts.
sightings
20
hosts
7
last hit
7 days ago
Poczta (Polish WP webmail) phishing kit — page YARA (content anchor)
highpoczta-webmail-kit-202607phishingmatches by YARAadded 2026-07-07
YARA content anchor for the Poczta webmail credential-phishing kit (sibling of the TLSH fuzzy-hash entry in this family). A custom authForm sends the login and password to a first-party /api/login endpoint, then redirects the victim to the real brand.
sightings
33
hosts
9
last hit
7 days ago
macOS ClickFix: fake verification kit ('Secure Gateway • Quick Verification', 'AuthKey • human verification') — page title
highmacos-clickfix-terminal-2026-10phishingmatches by queryadded 2026-10-01
Fake verification pages ('I'm not a robot', 'Manual verification', 'Verify you are human') that copy a shell command to the visitor's clipboard and tell Mac users to open Terminal with Command+Space, paste with Command+V and press Return. The pasted command downloads and runs a script, usually disguised: base64 decoded straight into a shell (for example bash <<< $(echo "…" | base64 -d)), or a download from a throwaway tunnel address piped into sh. Seen on Cloudflare Pages sites such as securecheckv1-proceed[.]pages[.]dev and quicksecurity-checkpointv1[.]pages[.]dev (since at least September 2026), whose payload hosts virelianmatrix[.]digital and aetherframework[.]digital are publicly labelled ClearFake; in a multi-platform ClickFix overlay injected into compromised websites, whose macOS branch fetches from escapeai[.]live (publicly labelled AMOS); and in a document-signing lure described in a September 2026 report on the AvisLoader malware. The script served to visitors of that Cloudflare Pages kit installs the Phexia macOS stealer, which stays running through a LaunchAgent and reads its command-and-control address from a smart contract on the Polygon blockchain, so the operator can move it to a new domain without changing the lure. No legitimate verification step asks visitors to run a command in Terminal. Since October 2026 the same kit also runs under the title 'AuthKey • human verification' (cf-securitycheckv1[.]pages[.]dev), copying the same kind of command; its payload hosts include frametoysbox[.]digital and bunbyteice[.]digital.
sightings
16
hosts
6
last hit
7 days ago
GoogVerify: fake Google Meet call that relays the Google password and 2-Step Verification to an operator
criticalgoogverify-meet-2fa-relay-kit-2026-10phishingmatches by YARA + queryadded 2026-10-20
Self-hosted phishing kit that calls itself "GoogVerify". The lure is a fake incoming Google Meet video call, with a ringtone and a request for the front camera, or a fake shared map location. Either one opens a Google sign-in. The email address and password go to the kit's own server, and the page then waits while the operator uses them on the real Google account. When Google sends its sign-in prompt to the victim's phone, the operator pushes the number from that prompt back to the page, and the victim is told to tap it, which completes the operator's sign-in. A wrong password sends the victim back to try again. Each copy has an operator panel and an install page, and copies have run on domains such as meet-google[.]cyou, meet-google[.]live, qooglo[.]com and l4-l4[.]site. A match means a page carrying the kit, its script or its installer, or a scan of one of its known hosts.
sightings
13
hosts
3
last hit
7 days ago
Multi-Brand pages.dev Phish Kit — jg.js (universal handler)
criticalmultibrand-pagesdev-phishphishingmatches by scriptadded 2026-05-27
Multi-brand credential-phishing kit deployed across 220+ *.pages.dev hosts under one operator. Brand cohorts: sso-godaddy (100h), update (39h), excel (16h), pdf/adobe/adobe-pdf (19h), 360-yandex-mail (9h), hostinger-mail (7h), nid-naver-mail (6h), zoho-mail, mailhostbox, nate-mail, dropbox, dhl, outlook-mail, office365-mail, we-tl, mail-one-update. Page title "Are you not a robot?" — fake-CAPTCHA pretext. jg.js is the shared handler script across all cohorts.
sightings
351
hosts
281
last hit
7 days ago
Multi-Brand pages.dev Phish Kit — js1.js (universal kit-internal)
criticalmultibrand-pagesdev-phishphishingmatches by scriptadded 2026-05-27
Universal kit-internal js1.js across the multi-brand pages.dev operator. 206 hosts.
sightings
347
hosts
272
last hit
7 days ago
Affiliate cookie-stuffing injector: hidden off-screen iframes delivered through ad tags
mediumaffiliate-cookie-stuffing-ok6-2026-10othermatches by queryadded 2026-10-14
A script chain served through popunder and push-notification ad tags. The ad tag returns a small loader that adds a script named ok6.js; that script, or a stat.js it loads, creates iframes placed far outside the visible page. The iframes pass through a redirector to affiliate links of large online shops (and some adult sites), so the operator is credited with commission on the visitor's later purchases: affiliate cookie stuffing. It is fraud against the merchants rather than an attack on the visitor, who sees nothing. A match means a page that loaded the injector or contacted one of its hops; the page owner usually did not add it themselves, it arrives with the ad network they use.
sightings
52
hosts
31
last hit
7 days ago
Multi-Brand pages.dev Phish Kit — sso-godaddy js.js
criticalmultibrand-pagesdev-phishphishingmatches by scriptadded 2026-05-27
GoDaddy SSO cohort js.js — 100 hosts.
sightings
158
hosts
127
last hit
8 days ago
RosyGuard cloaker: WebAssembly fingerprinting gate on Canadian bank and credit-union look-alikes
criticalrosyguard-cloaker-2026-10phishingmatches by YARA + queryadded 2026-10-13
Look-alike domains of Canadian business-banking portals and credit unions (CIBC Cash Management Online and Digital Business, RBC PayEdge, ScotiaConnect, and several credit unions' member sign-ins), mostly .at, .com and .gr.com names with one wildcard certificate per root. The server decides at the first request whether a visitor is wanted. A visitor it filters out, such as a scanner or a takedown crawler, is sent to an interstitial that calls itself the "RosyGuard corpus interstitial for FILTERED traffic". It loads /_af/sensor.wasm and two inline WebAssembly probes (relaxed-SIMD rounding quirks as a CPU and engine fingerprint, cache, store-forward and TLB timing to tell a virtual machine from real hardware, and the largest growable memory), signs the result, posts it to /.well-known/collect and /.well-known/collect2, and then redirects to the impersonated brand's real YouTube channel. Filtered visitors never see the lure, so a scan of a live member of this cluster usually ends on a YouTube consent page.
sightings
42
hosts
22
last hit
8 days ago
Blinder Tunnel: lure sites and relay of the Shelby espionage campaign against aviation and Gulf government targets
highblinder-tunnel-2026-10phishingmatches by queryadded 2026-10-12
Infrastructure of Blinder Tunnel, also reported as The Shelby Strategy (CL-STA-1178), an espionage campaign assessed as Iran-aligned that targets aviation, telecommunications and government organisations in Iraq and the Gulf. Victims receive a recruitment or meeting-app lure, such as a Dubai Airports IT test or the fake StarkMeet video-meeting app, that installs a .NET loader disguised as Microsoft's RuntimeBroker.dll. The loader takes its orders from a private GitHub repository, reached through a Cloudflare Workers relay, and when its GitHub token stops working it looks for new credentials hidden in comments on public GitHub issues. The same operator runs credential-phishing pages that imitate Google Drive, Google Meet, Microsoft 365 and the webmail of the Gulf Cooperation Council Secretariat and of Kuwait's foreign ministry. A match means a scan of one of these hosts, or a page that contacted one.
sightings
20
hosts
14
last hit
8 days ago
Japanese live-operator phishing panel (SMBC Vpass / docomo / Eki-net) — page code
criticaljp-live-panel-kit-2026-10phishingmatches by YARAadded 2026-10-02
Phishing sites aimed at people in Japan that imitate the SMBC Card member service 'Vpass', NTT docomo's 'd account' login and JR East's 'Eki-net', all built from one kit with numbered brand templates. The fake login page sends every keystroke of the ID and password to a live operator over a WebSocket connection and holds each submission until the operator moves the visitor on: card number, expiry date and security code, a one-time-code page styled for Visa, Mastercard, JCB or American Express, the card PIN, and phone or app verification. The sites answer only on the long, unique link sent to the victim (for example /login/smbc-CARD/lndex.html/entathl/jsp or /member/account/security/verification/account-information/details); the bare domain and every other path redirect to the real brand's website, so visiting the domain alone shows the genuine page. Hosts are short-lived: pinyin-style .com names registered many months before use and random .top names (e.g. teruid[.]com, rslny[.]com, szcxmd[.]com, zhongxiaokeji[.]com, xwqymywqsnswqhhq[.]top) on cloud servers in Singapore, and their DNS is often removed within hours. Seen since at least early July 2026. SMBC Card, docomo and JR East do not ask for a card PIN or one-time codes through a link in a text message or e-mail.
sightings
2
hosts
2
last hit
8 days ago
Japanese live-operator phishing panel (SMBC Vpass / docomo / Eki-net) — page title and kit files
highjp-live-panel-kit-2026-10phishingmatches by queryadded 2026-10-02
Phishing sites aimed at people in Japan that imitate the SMBC Card member service 'Vpass', NTT docomo's 'd account' login and JR East's 'Eki-net', all built from one kit with numbered brand templates. The fake login page sends every keystroke of the ID and password to a live operator over a WebSocket connection and holds each submission until the operator moves the visitor on: card number, expiry date and security code, a one-time-code page styled for Visa, Mastercard, JCB or American Express, the card PIN, and phone or app verification. The sites answer only on the long, unique link sent to the victim (for example /login/smbc-CARD/lndex.html/entathl/jsp or /member/account/security/verification/account-information/details); the bare domain and every other path redirect to the real brand's website, so visiting the domain alone shows the genuine page. Hosts are short-lived: pinyin-style .com names registered many months before use and random .top names (e.g. teruid[.]com, rslny[.]com, szcxmd[.]com, zhongxiaokeji[.]com, xwqymywqsnswqhhq[.]top) on cloud servers in Singapore, and their DNS is often removed within hours. Seen since at least early July 2026. SMBC Card, docomo and JR East do not ask for a card PIN or one-time codes through a link in a text message or e-mail.
sightings
2
hosts
2
last hit
8 days ago
status-account-NNN.pages.dev Scam Kit — index.js
highstatus-account-pagesdev-4455phishingmatches by scriptadded 2026-05-26
19-host operator running numbered Cloudflare Pages deployments: status-account-{8,10,13,14,16-21,43,53,70,71,75,122,123,124,125}.pages.dev. Hostnames are textbook account-suspended phishing pattern (Microsoft/Google "your account has been suspended" credential harvest).
sightings
28
hosts
21
last hit
9 days ago
EvilTokens 'ghost' AES-GCM cloaking loader (YARA)
criticalcloudflare_workers_phishingphishingmatches by YARAadded 2026-10-01
Device-code phishing pages that hide their lure behind an inline loader: an empty placeholder plus a script that decrypts an embedded AES-GCM blob and writes the result into the page with document.write, so the phishing page is assembled in the browser and never appears in the HTML the server sends. The lures seen so far imitate Adobe Acrobat Sign and DocuSign document-signing pages.
sightings
56
hosts
31
last hit
9 days ago
Google Ads fake document-app lures (AduelPaper, HaloDocket, LumenDocs) delivering the QuartzLine (CLOUDHAZE) backdoored PDF viewer
criticalquartzline-ad-doc-app-lures-2026-10phishingmatches by YARA + queryadded 2026-10-18
Search and display ads for invented free document apps (AduelPaper, HaloDocket, LumenDocs) that deliver QuartzLine, a working Windows PDF viewer with a hidden backdoor that runs commands for its operator and installs further malware (tracked by Mandiant as CLOUDHAZE). Active since at least July 2026. An ad shown on an unrelated website opens a one-page product site such as beatramiro[.]com, wolflingleader[.]com, purplepandagroup[.]com or weboughty[.]com. Its download button leads to a redirector on a second domain such as softwareslizards[.]com, zebrabrian[.]com or royalproductive[.]com, and from there to a short-lived link on an Amazon S3 bucket (duskhollow, flintvale, alberfine) that serves the installer. The app name on the page never matches the program that gets installed. The operator registers its domains in batches, parks them all at once when exposed, and blocks automated visitors soon after a site launches. A match means a page built from the lure template, or a scan of a campaign host.
sightings
9
hosts
9
last hit
9 days ago
"Protected document" invoice sign-in kit that sends credentials to Telegram
criticaladobe-protected-invoice-telegram-kit-2026-10phishingmatches by YARA + queryadded 2026-10-18
Credential phishing kit that poses as a protected document: an Adobe sign-in box over a blurred invoice from a made-up company, with the invoice number, dates and amount due shown beside the form. The victim's email address is filled in from the link they were sent. Everything typed is sent to the operator through Telegram, and the page then shows an "invalid credentials" error with a reference number whatever was entered, so victims try again with other passwords. The page is translated into 20 languages and picks one from the browser or the visitor's location. The kit sits in a folder on compromised websites and is reached through newly registered redirect domains such as invoice-adobe[.]com. A match means a page carrying the kit, or a scan of a known redirect domain.
sightings
4
hosts
2
last hit
9 days ago
Multi-Brand pages.dev Phish Kit — update cohort js.js
criticalmultibrand-pagesdev-phishphishingmatches by scriptadded 2026-05-27
"update" generic cohort js.js — 38 hosts.
sightings
56
hosts
44
last hit
9 days ago
Apple Account "Case ID" phishing panel behind a proof-of-work gate
criticalapple-case-id-route-panel-2026-10phishingmatches by YARA + queryadded 2026-10-17
Phishing campaign, active since at least June 2026, that registers Apple ID look-alike domains in two spellings: a word followed by -apple-id[.]com or -appleid[.]com, for example deny-apple-id[.]com, login-apple-id[.]com, settings-apple-id[.]com, signin-appleid[.]com or cases-appleid[.]com. A visitor first passes a browser check (a proof-of-work puzzle, a scoring of browser properties and sometimes a typed code); visitors that fail it see a fake "404 Not Found" page. The site then asks for a "Case ID", which suggests the victim is given one by someone posing as Apple support. After that, a human operator decides which page the victim sees next: fake Apple Account sign-in, passcode, two-factor, payment-card, billing, email or phone confirmation and "account on hold" pages. Everything typed is sent to the operator as it is typed, before the form is submitted, and the operator can redirect the victim at any time. Domains are registered a few at a time and many are suspended within days. A match means a page carrying the panel or its browser check, or a scan of a known campaign domain.
sightings
21
hosts
13
last hit
10 days ago
ClearFake / ClickFix 'enterprise2026' cluster — bscSl fake WordPress plugin loader (YARA)
criticalclearfake-enterprise26-2026-08phishingmatches by YARAadded 2026-09-25
Content match for the first stage on compromised WordPress sites: the fake plugin script bsc-loader.js (guard window.__bscSlRan) or the settings object WordPress prints for it, var bscSl = {ajaxUrl, nonce, action: "bsc_sl_get_script"}. The loader POSTs to the site's admin-ajax endpoint and injects the returned EtherHiding contract reader.
sightings
6
hosts
5
last hit
10 days ago
ClearFake / ClickFix 'enterprise2026' cluster — fake WordPress plugin path bsc-loader.js (script URL)
criticalclearfake-enterprise26-2026-08phishingmatches by queryadded 2026-09-25
Any scan whose page loaded a script at wp-content/plugins/<name>/js/bsc-loader.js, the fake plugin that starts the EtherHiding ClickFix chain on compromised WordPress sites. The plugin directory name is chosen per site to look legitimate (seen as modula-gallery-68 and exactmetrics-pro-2); the file name and its place in the plugin layout stay constant.
sightings
3
hosts
3
last hit
10 days ago
ClearFake / ClickFix 'enterprise2026' cluster — EtherHiding BSC testnet contract reader (YARA)
criticalclearfake-enterprise26-2026-08phishingmatches by YARAadded 2026-09-25
Content match for the second stage returned by the fake plugin: a script that skips bots and WordPress admin, feed and asset URLs, then calls get() (selector 0x6d4ce63c) on a BNB Smart Chain testnet contract through a list of public RPC nodes, ABI-decodes the returned string, base64-decodes it and injects it as a script, which loads the ClickFix lure.
sightings
3
hosts
3
last hit
10 days ago
ClearFake / ClickFix 'enterprise2026' cluster — fake WordPress plugin loader bsc-loader.js (exact content)
criticalclearfake-enterprise26-2026-08phishingmatches by queryadded 2026-09-25
The first stage on compromised WordPress sites is a fake plugin script, wp-content/plugins/<plausible-plugin-name>/js/bsc-loader.js (seen as modula-gallery-68 and exactmetrics-pro-2). It POSTs to the site's own admin-ajax endpoint with a localized bscSl {action, nonce, ajaxUrl} object and injects whatever script comes back, which then reads the EtherHiding contract. Guarded by window.__bscSlRan.
sightings
3
hosts
3
last hit
10 days ago
Brand look-alike doorway network: Russian copies of software and AI product pages funnelling to app[.]slidy[.]ai
lowslidy-brand-doorways-2026-10othermatches by queryadded 2026-10-17
Russian-language look-alike landing pages for well-known software and AI products (Google Slides, Google Docs, Microsoft Word, Excel and PowerPoint, Adobe Photoshop, Canva, CapCut, DeepSeek, Midjourney, ElevenLabs, Suno, Sora, Notion and others), registered as <brand>.com.ru, .net.ru, .org.ru, .pp.ru and .ru.net with one brand per IP address. The pages present themselves as the product without saying they are unofficial. Every "Try" button goes through the site's own /go/ path to the sign-up page of an AI subscription service (app[.]slidy[.]ai) whose trial renews automatically. No credential form or file download has been observed: this is deceptive marketing, not credential phishing or malware.
sightings
50
hosts
50
last hit
10 days ago
ClickFix FakeCAPTCHA — PowerShell variant
criticalclickfix-fakecaptchaphishingmatches by YARAadded 2026-05-27
Fake-CAPTCHA HTML page that copies a `powershell -enc <base64>` command to clipboard for the victim to paste into Win+R. Social-engineering pretext: "Verify you are human" / "Not a robot" / "Verification Steps" / "Press Windows Key + R / Ctrl + V / Enter". YARA rule reports 283 samples matched, >60% zero AV detection at time of analysis.
sightings
13
hosts
3
last hit
10 days ago
Lure hosting behind the password-manager look-alikes — 158.94.209.214 and the spicas.top nameservers
highspicas-dns-lure-cluster-2026-09phishingmatches by queryadded 2026-09-25
Two freshly registered password-manager look-alikes, 1password-login[.]com (registered 2026-09-24) and bitwarden-vault[.]org (2026-09-23), serve copies of the vendors' web sign-in pages ('Login to 1password', 'Login to Bitwarden Web Vault') to harvest master passwords, the one credential that unlocks every other account a victim has stored. Both are registered at Dynadot, are served from 158.94.209[.]214 and use the nameserver pair coral.spicas[.]top / harbor.spicas[.]top. That nameserver pair is not a public DNS service: spicas[.]top was registered on 2026-08-03, has no website, and its nameservers run on the same servers as the lures. The same pair serves roughly 75 other domains, almost all look-alikes: crypto-wallet software (Ledger Live, Trezor Suite, SafePal, Exodus, Trust Wallet), blockchain explorers and DeFi dashboards (Tronscan, DexScreener, DefiLlama), online banking, and software downloads, plus newly registered look-alikes of ordinary businesses. Many of these hosts put a 'Security Check' interstitial in front of the kit or return an error page to automated visitors, so a benign-looking capture on this infrastructure is not evidence that the page is harmless.
sightings
71
hosts
67
last hit
11 days ago
Kimsuky "Operation GitPower": Korean insurance and contract lures, PDF-disguised shortcuts delivered from GitHub
criticalkimsuky-gitpower-2026-10othermatches by YARA + queryadded 2026-10-16
Kimsuky's delivery of Windows shortcut (.lnk) malware to Korean targets through GitHub. Each repository holds one small ZIP named attachments_<Korean document name>.zip, such as an insurance claim (보험청구서), insurance papers (보험서류), an insurance policy (보험증권), a bond transfer contract (채권양도계약서) or a health check (건강검진). The ZIP contains a single shortcut with a PDF icon. Opening it runs a hidden PowerShell command carried as hex text. That command writes a second hex-encoded script to C:\Users\Public and schedules it to run every two minutes under an update-sounding task name (OneDriveUpdate…, MicrosoftEdgeUpdate…). It then opens a decoy PDF from a free-hosting site. The scheduled script polls a command server on free web hosting and runs whatever PowerShell it returns. A match means one of four things: a scan that downloaded one of these shortcuts (directly or inside the ZIP); a scan of a GitHub file with the campaign's path shape; a scan of a command-server request; or a scan of a decoy document with the campaign's file-name pattern.
sightings
7
hosts
3
last hit
11 days ago
Fake AI-tool installers and AI-ads invitations (Claude, ChatGPT, Gemini, Copilot, Codex, Ollama)
criticalfake-ai-tool-lures-2026-10phishingmatches by YARA + queryadded 2026-10-15
Pages that borrow the names of AI tools to get visitors to run malware or to hand over the Google or Meta Business account that runs their ads. Four page kits are tracked here. (1) Fake invitations to advertise on Gemini, Perplexity, ChatGPT, Claude or Meta's Muse: the page sends the visitor's IP address and location to its own back-end, checks whether that address is banned, and on 'Connect' draws a fake Google sign-in window inside the page (browser-in-the-browser) to collect the password. (2) Copies of the install pages of Claude Code, GitHub Copilot CLI, Ollama, OpenAI Codex and Kimi Code whose one-line install command points at the copy's own install.ps1. That script is the vendor's real installer with two lines added that start a hidden PowerShell window downloading further malware, so the developer still gets a working tool. (3) Copies of the 'Download Claude' page whose install command is kept encrypted in the page and is shown only after a click, in a pop-up telling the visitor to paste it into the Run box or Terminal. (4) Download pages for fake desktop apps (a budgeting app and others) whose installer is hosted on GitHub releases and whose download button reports each click to the operator's server. A match means a scan of one of these pages, a page that contacted one of the invitation kit's back-ends, or one of the altered install scripts.
sightings
13
hosts
9
last hit
11 days ago