Tracked hunts and campaigns, each anchored to a script fingerprint, a YARA rule, a search query or a TLS certificate. Every scanned script and page is matched against them automatically.
299 hunts·35 hit in the last 24 hours·59,477 sightings
highpionex-impersonation-b14bphishingmatches by scriptadded 2026-05-26
5-host operator impersonating Pionex (real crypto trading bot platform): pioddnexqye.com, pionexadv.com, etc. The "pionex" substring is the operator's mimicry of the brand.
highforum-tld-sister-cc0aphishingmatches by scriptadded 2026-05-27
Sister cohort #2 of the .forum-TLD rotation family. 17 hosts with random 10-char hostnames (hvwvwvjwso.forum, nbilrwodrt.forum, …). Different build hash from f969.
highforum-tld-kit-b86d1aphishingmatches by scriptadded 2026-05-26
Vue.js webpack SPA deployed across 40 hostnames ALL on the .forum TLD with 8-character random hostnames (cmkpxlpv.forum, lhivtxfx.forum, ruxkxjyybs.forum, …). The uniformity of TLD + filename-length is a strong operator signal.
highpagesdev-vue-investment-scamphishingmatches by scriptadded 2026-05-26
Cloudflare-Pages-hosted Vue.js fake-investment kit. ONE operator running brand cohorts (vindax/mint/digtal/pimco impersonation) on *.pages.dev, all sharing the same Vue.js webpack skeleton with cohort-specific branding strings. This anchor catches the vindax-1xy / vindax-9io / mint-5st cohort.
highforum-tld-sister-f969phishingmatches by scriptadded 2026-05-27
Sister cohort of forum-tld-kit-b86d1a / forum-tld-kit-6ed2. 39 .forum hosts with uniform 8-char random hostnames (bgvwaihj.forum, bosmehqu.forum, …). Path pattern /js/app.<hash>.js — different chunk path than the earlier forum kits.
criticalokta-passtokenphishingmatches by queryadded 2026-09-26
Same Okta-themed phishing kit as the PassToken script hunt in this family, matched on its landing URL instead of its client script. Deployments open on /index.php?passtoken=&redirect=/ on look-alike domains named after the targeted company, such as <company>sso.com, <company>internal.com and my<company>.com, behind a "Verifying your connection" gate. This row catches deployments whose client script differs from the anchored build, or that did not load it during capture.
criticalokta-passtokenphishingmatches by scriptadded 2026-05-26
Okta-themed brand-impersonation phishing kit. Landing URL has the ?passtoken=&redirect=/ signature; backend.php polls for MFA-bypass state; pingServer heartbeat; Telegram-channel credential exfiltration. Attributed to the ShinyHunters cluster.
criticalmetamask-support-seo-srp-kit-2026-10phishingmatches by YARA + queryadded 2026-10-20
Phishing kit posing as MetaMask's support centre, built to be found by people searching for how to contact MetaMask support. The page copies the real support site and is stuffed with search phrases and a fake FAQ. Its "Connect wallet" button opens a box that pretends the connection failed and offers to "Login Manually". That step asks for the 12-word Secret Recovery Phrase, checks every word against the standard wallet word list and marks wrong words in red, so the victim corrects them before submitting. The phrase is sent to a third-party form service, and the victim is then sent on to the real MetaMask support site so nothing looks wrong. MetaMask support never asks for a recovery phrase. The kit has run on contactmetamask[.]top. A match means a page carrying the kit's script, or a scan of one of its known hosts.
highclickfix-cache-smuggling-2026-10phishingmatches by queryadded 2026-10-04
The overlay Microsoft Threat Intelligence published on 2026-10-03 is a Cloudflare-style box ('Verifying…', 'Let us know you're human, please complete steps') with three numbered steps: press Windows key + R 'to open the verification dialog', press Ctrl + V 'to paste the confirmation code', and press Enter 'to confirm you're not a robot', followed by a Ref ID. The wording calls the Run dialog a 'verification dialog' and the copied command a 'confirmation code'. No legitimate verification step asks visitors to open the Run dialog.
criticalclickfix-cache-smuggling-2026-10phishingmatches by YARAadded 2026-10-04
Fake verification overlays on compromised websites (a Cloudflare-style 'Verifying…' box that tells the visitor to press Windows key + R, paste with Ctrl+V and press Enter) whose copied command contains no web address. Before the visitor does anything, the page loads the real payload, a VBScript or batch file, as if it were an image, so the browser stores it in its cache. The pasted cmd.exe one-liner walks the browser profile folder (for /r over %LOCALAPPDATA%), picks the cached file by its exact size (if %~zf==33433) or by a marker string inside it (findstr /m /c:), copies it to %TEMP% under a script name such as t.vbs or t.cmd, and runs it. Reported by Microsoft Threat Intelligence on 2026-10-03: the VBScript fetches a PowerShell stage from cocojambo[.]us[.]com, which leads to credential theft and a Python backdoor contacting capsysnet[.]vg and ciliabula[.]cc. Expel and Crimson7 described the same technique earlier. No legitimate verification step asks visitors to run a command.
criticalclearfake-everything-sideload-2026-09phishingmatches by queryadded 2026-09-25
ClickFix chain delivered from compromised websites through a fake CAPTCHA. The visitor pastes a PowerShell one-liner that fingerprints the machine (MachineGuid, volume serial, computer name) and beacons to king.allwwewrestlers.com, which returns an AES-encrypted next stage keyed on that fingerprint. The stage drops a signed copy of the Everything file-search tool that sideloads a trojanized WindowsCodecs.dll (sha256 7c3c4d709bd1146dd1f3e910526894625393230f983b9b02737d4cf62326c41d), which reflectively loads a backdoor (sha256 a22e25b0573366112236a2f519cec8f8129ea54c413572ae29be2ed31efcf5e2) with screen capture and download-and-execute. The backdoor resolves its C2 from a Telegram channel bio (t.me/s/molerkorstarstot, giving pidor.catalogotrader.com), falling back to an Ethereum contract (0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E, giving frog.britishboxing.net). The C2 names are subdomains of older, unrelated-looking domains.
