Tracked hunts and campaigns, each anchored to a script fingerprint, a YARA rule, a search query or a TLS certificate. Every scanned script and page is matched against them automatically.
299 hunts·35 hit in the last 24 hours·59,467 sightings
criticalcasbaneiro-extension-panel-2026-10stealermatches by YARA + queryadded 2026-10-15
Operator web panel of a malicious Chromium browser extension that is installed together with the Casbaneiro banking trojan (also known as Metamorfo and Ponteiro), which targets customers of Portuguese and Brazilian banks, cryptocurrency exchanges and webmail services. Infection starts with a phishing e-mail that leads the victim to install a remote-access client, through which the operators run PowerShell, side-load the trojan's DLL and load the extension into the victim's browser. The extension takes screenshots, steals cookies, captures every form field the victim fills in, including passwords, and injects fake HTML overlays into banking pages on the operator's command. It finds its current server by downloading a small base64-encoded text file from a resolver host and then keeps a WebSocket connection to that server. The panel that controls it is served over plain HTTP on bare IP addresses, in a Portuguese build that brands itself 'Painel Gangster' (login page 'Painel de Monitoramento') and an English build titled 'Monitoring Panel'. This hunt matches the panel's dashboard and login pages by their page code, and tracks the known panel addresses and the resolver and download hosts.
highwarden-stealer-2026-10stealermatches by queryadded 2026-10-09
Command-and-control servers of Warden Stealer, a Rust infostealer sold as a subscription service since mid-2026 (earlier tracked as CallbackBeaver). It steals browser passwords and cookies (including a bypass of Chrome's App-Bound Encryption), more than 200 crypto-wallet extensions, messenger, password-manager, 2FA and VPN data, and the local data of AI coding tools (Claude, Codex, Cursor, Grok): tokens, MCP credentials and conversation history. A clipboard clipper swaps copied wallet addresses for the operator's. Customers spread it through ClickFix pages, cracked software, game cheats and malicious ads, usually as a loader that injects the stealer into explorer.exe. A match means a scan of one of these servers, or a page that contacted one. Each server sits behind Cloudflare, and a browser visit gets a Cloudflare 520 error or Cloudflare's own suspected-malware warning page, never content of its own.
criticalmeetly-fake-meeting-update-2026-10phishingmatches by YARA + queryadded 2026-10-14
A fake video-meeting join page hosted in a cloud storage bucket. It shows the Zoom logo on a generic template whose own text calls the product 'Meetly'. The visitor is asked for an 11-digit meeting ID and a display name; after a short 'Joining meeting' spinner the page claims 'Sorry, your workspace is out of date' and its Update button downloads zoom-workspace.exe from a separate storage bucket. The file is a genuine, validly signed remote-management (RMM) agent installer that is pre-configured to enroll the computer into the operator's own account, which gives the operator remote control of the machine. Seen on zoom-meet-invite7845957.s3.us-east-1.amazonaws[.]com (uploaded 2026-10-12), with the installer at pub-9fad4cf58ddf41d6b8a66e8621858802.r2[.]dev.
highokta-company-lookalike-2026-09phishingmatches by queryadded 2026-10-13
Look-alike domains for Okta single sign-on pages of specific companies, registered since September 2026 and hosted on one server, 196.251.121[.]218: the company name joined to okta (attentive-okta[.]com, yotpo-okta[.]com, paddleokta[.]com, moengageinc-okta[.]com, contentfulokta[.]com, oktadialpad[.]com, listrak-okta[.]com), plus ServiceNow ticket look-alikes (servicenow-ticket[.]com and numbered variants) and vzw-web-portal[.]com. Naming a domain after one target company's identity provider is the pattern of voice-phishing campaigns that call employees and walk them through a fake sign-in or MFA reset. The server answers automated visitors with a short "Service temporarily unavailable" error, so no page content has been captured, and most of the domains were suspended within days of registration. A match means a scan of one of these domains or of the server.
highfinal-notice-drive-goto-2026-10phishingmatches by queryadded 2026-10-13
Debt-collection phishing campaign, active since mid-September 2026, that abuses genuine Google Drive share notifications. From throwaway Google accounts the operator shares a fake demand letter from a well-known law firm, with look-alike Cyrillic, Greek or Cherokee letters in the title and sender name so that keyword filters miss it. The letter's button leads through Google's redirector to a blank page in a randomly named Google Cloud Storage bucket, which passes the visitor within about a second to a gate server running the Keitaro traffic distribution system. Automated visitors are sent on to Yahoo or Google; selected Windows visitors receive a VBScript named e-Sign-Key-Access-ID<digits>.vbs. The script asks for administrator rights, reads the location of an MSI installer from a second Cloud Storage object and silently installs a GoTo Resolve remote-support agent, which gives the operator interactive access to the computer. A match means a scan of a Cloud Storage page with the campaign's generated path, of a gate host, or of a page that contacted a gate server.
highjp-live-panel-kit-2026-10phishingmatches by queryadded 2026-10-02
Phishing sites aimed at people in Japan that imitate the SMBC Card member service 'Vpass', NTT docomo's 'd account' login and JR East's 'Eki-net', all built from one kit with numbered brand templates. The fake login page sends every keystroke of the ID and password to a live operator over a WebSocket connection and holds each submission until the operator moves the visitor on: card number, expiry date and security code, a one-time-code page styled for Visa, Mastercard, JCB or American Express, the card PIN, and phone or app verification. The sites answer only on the long, unique link sent to the victim (for example /login/smbc-CARD/lndex.html/entathl/jsp or /member/account/security/verification/account-information/details); the bare domain and every other path redirect to the real brand's website, so visiting the domain alone shows the genuine page. Hosts are short-lived: pinyin-style .com names registered many months before use and random .top names (e.g. teruid[.]com, rslny[.]com, szcxmd[.]com, zhongxiaokeji[.]com, xwqymywqsnswqhhq[.]top) on cloud servers in Singapore, and their DNS is often removed within hours. Seen since at least early July 2026. SMBC Card, docomo and JR East do not ask for a card PIN or one-time codes through a link in a text message or e-mail.
criticalclickfix-windows-security-dialog-2026-10phishingmatches by YARAadded 2026-10-01
Compromised websites whose homepage is replaced, for Windows visitors only, by a fake reCAPTCHA-style checkbox that opens a 'Windows Security — Human verification required' dialog. The dialog copies a command to the clipboard and tells the visitor to press Windows key + R, paste with Ctrl+V and press Enter. The command uses mshta to download an executable from a file-sharing link, save it as %TEMP%\verification.exe and run it; the payload has been reported as an information stealer. Closing the dialog only makes it reappear. Visitors on macOS or a phone see the normal website, so site owners rarely notice. Seen on 2026-10-01 on unrelated WordPress sites at three hosting providers, all serving the same page. No legitimate verification step asks visitors to run a command.
highteams-fake-update-kit-2026-10phishingmatches by YARA + queryadded 2026-10-08
A copy of the Microsoft Teams pre-join screen on a look-alike domain, at a path shaped like a real meeting link (/l/meetup-join/19:[email protected]/0). The page asks for the visitor's name and sends it to the operator. Links created in the kit's admin panel then switch to a 'You need to update Microsoft Teams' screen, and its Update Teams button downloads a file the operator chose for that link (/api/works/<id>/file). Phones and tablets get an 'Unsupported Device' screen, so only desktop visitors see the lure. A dormant variant of the page instead claims the browser cannot handle the meeting audio and offers a 'Desktop app' download. Seen on teams-online[.]com, registered 2026-10-04.
criticalclickfix-cf-modal-remote-cmd-2026-10phishingmatches by YARAadded 2026-10-04
Throwaway domains with cooking and grilling names (recipebistro[.]com, kitchensecretbook[.]com, progrillmenu[.]com, perfectgrillmeals[.]com and many similar) that serve a copy of Google's Merchant Center marketing page. Any click on a link or button opens a fake Cloudflare / reCAPTCHA verification box that tells the visitor to press Windows key + R, then Ctrl+V, then Enter. At the same moment the page downloads the command text from its server and places it on the clipboard, so the command never appears in the page itself. Seen since early September 2026, each domain on its own rented server. In early October 2026 the operator had left the command address unfilled ({{WINR}}), so the copied text was the page itself; the same page becomes dangerous as soon as a real address is filled in. No legitimate verification step asks visitors to run a command.
highclickfix-cf-modal-remote-cmd-2026-10phishingmatches by queryadded 2026-10-04
Pages titled like Google's Merchant Center marketing page ('Promote Your Business with Merchant Center') served from domains that are not Google's. In this campaign the copy is hosted on throwaway domains with cooking and grilling names and carries a hidden fake Cloudflare check that copies a command for the Windows Run dialog (Windows key + R, Ctrl+V, Enter).
highclickfix-cache-smuggling-2026-10stealermatches by queryadded 2026-10-04
Servers used after the pasted command has run, in the ClickFix cache-smuggling campaign reported by Microsoft Threat Intelligence on 2026-10-03. The VBScript taken from the browser cache retrieves a PowerShell stage (v.ps1) from cocojambo[.]us[.]com/alfa; the credential-stealing code injected into timeout.exe retrieves another stage from capsysnet[.]vg and connects to ciliabula[.]cc. Browsed directly on 2026-10-04, cocojambo[.]us[.]com was blocked by its CDN as suspected malware, capsysnet[.]vg redirected to the site of an unrelated, legitimate webmail provider, and ciliabula[.]cc showed a login page.
highfilefix-explorer-2026-10phishingmatches by queryadded 2026-10-04
A Russian-language fake reCAPTCHA titled 'Подтверждение доступа' (access confirmation) copies an encoded PowerShell command and tells the visitor to press Win+E, Ctrl+L, Ctrl+V and Enter, which runs it from the File Explorer address bar. The command downloads run.ps1, which mounts nomad.iso and starts test_ndfl.lnk; the shortcut opens a genuine tax-office PDF as a decoy and runs List_ndfl_2026.pdf.exe, which sends the user name and computer name to a public request-collection service. One server hosts it under hostnames that imitate internal services of Russian banks, insurers and other companies (vpn., buh., cisco., dms., login., mx1.prod.), adding one company at a time since June 2026, e.g. buh.reallstbank[.]ru, cisco.parivpn[.]ru, mx1.prod.rossko[.]su, alfastrahv[.]ru, dms.cabinet-ingos[.]ru. Reported publicly by @Malwarehunterr on 2026-10-02.
highcountloader-c2-gmx-decoy-2026-10othermatches by queryadded 2026-10-04
Command-and-control servers of CountLoader, a PowerShell loader that installs further malware and keeps itself running through scheduled tasks. These servers show no page to an ordinary visitor: the web server answers every request with a permanent redirect to www.gmx[.]net, the home page of an unrelated, legitimate German webmail provider, which is not involved. The domains use uncommon top-level domains (.vg, .cc, .gl), Cloudflare name servers and a server address of their own. Public threat lists label alphastore[.]vg, twit-follow[.]vg, urugvai[.]cc, ultahost[.]gl, holiday-forever[.]cc and alpha-centavr[.]cc as CountLoader. SOCRadar's August 2026 report on the DOUBLECUP ClickFix delivery service lists alphastore[.]vg as a DOUBLECUP delivery host and CountLoader server. capsysnet[.]vg, which Microsoft Threat Intelligence named on 2026-10-03 as a later-stage server in a ClickFix campaign that hides its payload in the browser cache, answers with the same redirect. Every domain seen so far on 79.124.59[.]146 is publicly labelled CountLoader or an information stealer.
criticalclickfix-branded-cf-challenge-2026-10phishingmatches by YARAadded 2026-10-02
Throwaway lookalike domains (claudedevz[.]net, openai-credit[.]com, googlegeminidev[.]com, higgsflield[.]net, strategyvote[.]com and others) that serve a fake Cloudflare 'Performing security verification' page showing the name and icon of a well-known AI service or crypto brand (Claude, OpenAI, Gemini, Higgsfield, Strategy, Robinhood, OKX). The page copies a command to the clipboard and tells the visitor to paste it into the Windows Run dialog (Windows key + R, Ctrl+V, Enter) or into Terminal on macOS. On Windows the command is obfuscated PowerShell that downloads a ZIP containing a trojanized GitHub Desktop (a backdoored resources/app/main.js) and starts it from a scheduled task; on macOS it pipes a downloaded script into zsh or bash. The lures promise free API credits or bonuses. Seen since July 2026; the download servers change every few weeks while the page stays the same. No legitimate verification step asks visitors to run a command.
criticaljoomla-admin-login-skimmer-2026-10stealermatches by YARA + queryadded 2026-10-16
Script injected into compromised Joomla websites. It keeps its code as two base64 strings, an XOR key and the payload, and runs the decoded code with new Function. The code waits for the site's administrator login form, reads the username and password when the password field loses focus or Enter is pressed, and posts them with the page address to the script's own host, which poses as a JavaScript CDN (reactjscdn[.]com, scripts named after jQuery files under /joomla/).
highjp-live-panel-kit-2026-10phishingmatches by queryadded 2026-10-02
Phishing sites aimed at people in Japan that imitate the SMBC Card member service 'Vpass', NTT docomo's 'd account' login and JR East's 'Eki-net', all built from one kit with numbered brand templates. The fake login page sends every keystroke of the ID and password to a live operator over a WebSocket connection and holds each submission until the operator moves the visitor on: card number, expiry date and security code, a one-time-code page styled for Visa, Mastercard, JCB or American Express, the card PIN, and phone or app verification. The sites answer only on the long, unique link sent to the victim (for example /login/smbc-CARD/lndex.html/entathl/jsp or /member/account/security/verification/account-information/details); the bare domain and every other path redirect to the real brand's website, so visiting the domain alone shows the genuine page. Hosts are short-lived: pinyin-style .com names registered many months before use and random .top names (e.g. teruid[.]com, rslny[.]com, szcxmd[.]com, zhongxiaokeji[.]com, xwqymywqsnswqhhq[.]top) on cloud servers in Singapore, and their DNS is often removed within hours. Seen since at least early July 2026. SMBC Card, docomo and JR East do not ask for a card PIN or one-time codes through a link in a text message or e-mail.
mediumsnowshoe-mailer-kit-2026-09othermatches by queryadded 2026-09-28
Web kit installed on bulk-mail ('snowshoe') spam-sending servers. Each throwaway domain sits on its own IP at a small hosting provider (Apache on Ubuntu, wildcard certificates) and serves three things: a decoy homepage titled 'Home | <domain>' that reprints a New York Times RSS section so the sender looks like a real website; a click tracker at /redirect.html?od=<token> that sends real recipients on to affiliate offers (online casinos, 'you won' prize pages, fake security warnings) and bounces recognised security scanners to a major brand's homepage; and an /out.php?email=<address> 'Unsubscribe' page pre-filled with the recipient's address, which confirms to the sender that the address is live. The domains are randomly named (e.g. thapiourgo[.]com, quisenagid[.]net, kulas.allidity[.]info, rempel.mereanreng[.]org), often with a surname as subdomain, and are replaced within weeks. Seen since at least December 2024 and still active in September 2026.
highindia-income-tax-notice-kit-2026-09phishingmatches by YARAadded 2026-09-26
Pages posing as India's Income Tax Department (Ministry of Finance) that show a bilingual Hindi/English 'Office Memorandum' — a 'Tax Compliance Deficiency and Penalty Notice' citing Sections 271(1)(c) and 276C, a 72-hour deadline and a signature from an invented Assistant Commissioner — and push a 'documents' download to desktop visitors. The download is an archive or disk image (ZIP with a double-extension .exe.exe and a side-loaded DLL, or .VHD/.IMG/.RAR) that installs malware; phones get a 'please open on a computer' message instead. The pages run on short-lived, randomly named domains across many TLDs (e.g. pldnf[.]top, ckrotbin[.]biz, gov-xnui[.]com, xjxfxn[.]com, hcgxt[.]com, novazon[.]sbs, bytepulse[.]mom, nexcore[.]help), mostly behind Cloudflare, since at least August 2026. The Income Tax Department does not send penalty notices through such sites; genuine notices are available only after signing in at incometax.gov.in.
highindia-income-tax-notice-kit-2026-09phishingmatches by queryadded 2026-09-26
Pages posing as India's Income Tax Department (Ministry of Finance) that show a bilingual Hindi/English 'Office Memorandum' — a 'Tax Compliance Deficiency and Penalty Notice' citing Sections 271(1)(c) and 276C, a 72-hour deadline and a signature from an invented Assistant Commissioner — and push a 'documents' download to desktop visitors. The download is an archive or disk image (ZIP with a double-extension .exe.exe and a side-loaded DLL, or .VHD/.IMG/.RAR) that installs malware; phones get a 'please open on a computer' message instead. The pages run on short-lived, randomly named domains across many TLDs (e.g. pldnf[.]top, ckrotbin[.]biz, gov-xnui[.]com, xjxfxn[.]com, hcgxt[.]com, novazon[.]sbs, bytepulse[.]mom, nexcore[.]help), mostly behind Cloudflare, since at least August 2026. The Income Tax Department does not send penalty notices through such sites; genuine notices are available only after signing in at incometax.gov.in.
highokta-passtokenphishingmatches by queryadded 2026-09-26
Two domains publicly reported on 2026-09-25 as likely ShinyHunters infrastructure: passkey-settings[.]com, and accounts-auth[.]com at low confidence. Public threat lists also label both under the 0ktapus SSO phishing cluster. The passkey-settings name follows the passkey and SSO enrolment theme of this group's identity-provider phishing.
criticalclearfake-everything-sideload-2026-09phishingmatches by queryadded 2026-09-25
Browser-side stage of the ClickFix chain that ends in a signed Everything.exe sideloading a trojanized WindowsCodecs.dll (see the C2-host row in this family). Compromised websites load check.first-node.rocks/api/script.js?t=<site token>, which reads a smart contract through public Polygon RPC endpoints (EtherHiding) and hands off to a traffic-distribution server on a rotating subdomain of blinqueofficial.com (cup., barn., earl.). The TDS answers /api/?a=tds_cfg, serves a large fake Cloudflare verification script (cf.js), and polls /api/?a=check_dl while waiting for the visitor to paste and run the staged PowerShell command.
highunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing linked in public reporting to UNC6671 (the actor Google Threat Intelligence describes targeting financial services and enterprise cloud environments) and listed by public threat lists under the 0ktapus (Scattered Spider-style) SSO phishing cluster. Each lure host is a subdomain named after the targeted organisation (for example xai., simplisafe., branch., icann., marsh., vertiv., selecthealth., billcom., acorns., ciena.) under a shared, generic account or passkey themed domain: myaccountapps[.]com, my-passkeys[.]com, passkey-mfa[.]com and register-passkeys[.]com, registered between 2026-09-02 and 2026-09-18 through the same registrar (NICENIC); my-passkeys and register-passkeys have since been put on registrar hold. The passkey theme targets MFA and passkey enrolment, the step that lets an attacker register their own authenticator on a victim's account. A DNS change around 2026-09-24 exposed the servers behind the hostnames: 46.19.136[.]147 (myaccountapps) and 46.19.136[.]148 (the passkey domains), both at Private Layer.
criticalunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing linked in public reporting to UNC6671 (the actor Google Threat Intelligence describes targeting financial services and enterprise cloud environments) and listed by public threat lists under the 0ktapus (Scattered Spider-style) SSO phishing cluster. Each lure host is a subdomain named after the targeted organisation (for example xai., simplisafe., branch., icann., marsh., vertiv., selecthealth., billcom., acorns., ciena.) under a shared, generic account or passkey themed domain: myaccountapps[.]com, my-passkeys[.]com, passkey-mfa[.]com and register-passkeys[.]com, registered between 2026-09-02 and 2026-09-18 through the same registrar (NICENIC); my-passkeys and register-passkeys have since been put on registrar hold. The passkey theme targets MFA and passkey enrolment, the step that lets an attacker register their own authenticator on a victim's account. A DNS change around 2026-09-24 exposed the servers behind the hostnames: 46.19.136[.]147 (myaccountapps) and 46.19.136[.]148 (the passkey domains), both at Private Layer.
highconsentfix-oauth-code-2026-09phishingmatches by queryadded 2026-09-25
Lure domains published by Push Security for the first observed ConsentFix campaign, which gated the page behind a fake Cloudflare Turnstile asking for a business email address before showing the Azure CLI sign-in and the 'paste the localhost URL' instructions.
highteje-rotating-domainphishingmatches by scriptadded 2026-05-26
Webpack-bundled SPA deployed across an 8-host rotation that all share the `teje` prefix on cheap/suspicious TLDs (tejehqnfih.work, tejehqzjxt.club, tejeiviusk.asia, tejeiwdeow.cloud, tejeiycpyh.asia, tejeizzifa.wiki, …).
criticalmacfinger-clickfix-2026-09stealermatches by scriptadded 2026-09-23
Byte-identical copies of the Macfinger ClickFix fingerprinting script ext-b.4f9db6afd06a.js, the build current in late September 2026, which decides whether to show the fake verification page.
