{"type":"bundle","id":"bundle--9d60643d-58dd-48ae-9d95-a07d19b79864","objects":[{"type":"identity","spec_version":"2.1","id":"identity--91f4ec79-59a0-4995-ba51-b1a09b5bbd8c","created":"2026-09-15T22:19:18.415Z","modified":"2026-09-15T22:19:18.415Z","name":"ZeroHour","identity_class":"system","description":"Indicators auto-extracted from public security reporting. Verify before use."},{"type":"indicator","spec_version":"2.1","id":"indicator--91dca154-c9b1-46e4-a767-06698c39f579","created":"2026-09-13T01:10:01.000Z","modified":"2026-09-15T22:19:18.415Z","created_by_ref":"identity--91f4ec79-59a0-4995-ba51-b1a09b5bbd8c","name":"sha1: 072558bc1a539e9936584647df51fb1797c982b0","description":"Seen in \"Re: UnrealIRCd 6.2.7 released & hot-patch to fix security issues for existing installations\" (oss-security). Context: mes writes: https://github.com/unrealircd/unrealircd/commit/072558bc1a539e9936584647df51fb1797c982b0. It's a great example of the shape of many LLM-reported (I'","pattern":"[file:hashes.'SHA-1' = '072558bc1a539e9936584647df51fb1797c982b0']","pattern_type":"stix","valid_from":"2026-09-13T01:10:01.000Z","labels":["auto-extracted","vulnerability"],"confidence":30,"external_references":[{"source_name":"oss-security","url":"https://seclists.org/oss-sec/2026/q3/729"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--21834f0d-0a12-476c-bf31-d25279953ef3","created":"2026-09-11T09:59:29.000Z","modified":"2026-09-15T22:19:18.415Z","created_by_ref":"identity--91f4ec79-59a0-4995-ba51-b1a09b5bbd8c","name":"sha1: 513a907b69edffc3cb77a494da395178d21ef9bd","description":"Seen in \"Hackers Exploit JFrog Artifactory Flaws to Bypass Authentication and Gain Admin Access\" (GBHackers). Context: mtp Second-stage payload download URL 2026-09-07 2026-09-08 513a907b69edffc3cb77a494da395178d21ef9bd SHA-1 hash of /tmp/.z payload 2026-09-06 2026-09-08 64.207.","pattern":"[file:hashes.'SHA-1' = '513a907b69edffc3cb77a494da395178d21ef9bd']","pattern_type":"stix","valid_from":"2026-09-11T09:59:29.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-exploit-jfrog-artifactory-flaws/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1cf530c-33bd-4ede-8d38-704b312a9936","created":"2026-09-11T08:17:33.000Z","modified":"2026-09-15T22:19:18.415Z","created_by_ref":"identity--91f4ec79-59a0-4995-ba51-b1a09b5bbd8c","name":"sha1: 513a907b69edffc3cb77a494da395178d21ef9bd","description":"Seen in \"JFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative Control\" (Cyber Security News). Context: mtp , hxxp://3.88.162[.]79:36789/smtp File / Hash /tmp/.z — 513a907b69edffc3cb77a494da395178d21ef9bd Account 0xterror , svc_[a-zA-Z0-9]{8} , Nxploited_[a-zA-Z0-","pattern":"[file:hashes.'SHA-1' = '513a907b69edffc3cb77a494da395178d21ef9bd']","pattern_type":"stix","valid_from":"2026-09-11T08:17:33.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/jfrog-artifactory-vulnerabilities-actively-exploited/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe671532-c8a4-4153-8413-47c3d643076d","created":"2026-09-10T19:04:00.000Z","modified":"2026-09-15T22:19:18.415Z","created_by_ref":"identity--91f4ec79-59a0-4995-ba51-b1a09b5bbd8c","name":"sha1: 513a907b69edffc3cb77a494da395178d21ef9bd","description":"Seen in \"Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329\" (Wiz Blog). Context: 026-42018/CVE-2026-42016 exploitation 2026-09-07 2026-09-08 513a907b69edffc3cb77a494da395178d21ef9bd SHA1 of /tmp/.z payload 2026-09-06 2026-09-08 64.207.232[.]","pattern":"[file:hashes.'SHA-1' = '513a907b69edffc3cb77a494da395178d21ef9bd']","pattern_type":"stix","valid_from":"2026-09-10T19:04:00.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"Wiz Blog","url":"https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a65eda2e-2647-480a-8904-8df4ef38e5be","created":"2026-09-10T09:53:52.000Z","modified":"2026-09-15T22:19:18.415Z","created_by_ref":"identity--91f4ec79-59a0-4995-ba51-b1a09b5bbd8c","name":"sha1: 59508d071661ea70fa5fcbe6f9e2fb72506e57df","description":"Seen in \"Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware\" (Cyber Security News). Context: a4cccbc3d511dc8d7f24b113 MacSync sample MD5 hash SHA-1 hash 59508d071661ea70fa5fcbe6f9e2fb72506e57df MacSync sample SHA-1 hash Code-signing identifier com.utils","pattern":"[file:hashes.'SHA-1' = '59508d071661ea70fa5fcbe6f9e2fb72506e57df']","pattern_type":"stix","valid_from":"2026-09-10T09:53:52.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-claude-and-chatgpt-installers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5aa39e60-d331-4090-87cf-97b4c8bd37af","created":"2026-09-10T09:53:52.000Z","modified":"2026-09-15T22:19:18.415Z","created_by_ref":"identity--91f4ec79-59a0-4995-ba51-b1a09b5bbd8c","name":"sha1: d182eb7cba0ffa42d770d7b0d3499e49f24163a2","description":"Seen in \"Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware\" (Cyber Security News). Context: ils.Launcher Ad-hoc-signed MacSync stager identifier CDHash d182eb7cba0ffa42d770d7b0d3499e49f24163a2 Code directory hash associated with the sample Staged archi","pattern":"[file:hashes.'SHA-1' = 'd182eb7cba0ffa42d770d7b0d3499e49f24163a2']","pattern_type":"stix","valid_from":"2026-09-10T09:53:52.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-claude-and-chatgpt-installers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3e3855a-88a4-4ac5-a4e5-b177102b55e1","created":"2026-09-10T07:01:43.000Z","modified":"2026-09-15T22:19:18.415Z","created_by_ref":"identity--91f4ec79-59a0-4995-ba51-b1a09b5bbd8c","name":"sha1: 59508d071661ea70fa5fcbe6f9e2fb72506e57df","description":"Seen in \"Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.\" (GBHackers). Context: cbc3d511dc8d7f24b113 Native Mach-O Stager Binary SHA-1 Hash 59508d071661ea70fa5fcbe6f9e2fb72506e57df Native Mach-O Stager Binary Code Signing ID com.utils.Launc","pattern":"[file:hashes.'SHA-1' = '59508d071661ea70fa5fcbe6f9e2fb72506e57df']","pattern_type":"stix","valid_from":"2026-09-10T07:01:43.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/clickfix-lures-target-macos/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--69dbf2cc-5324-4090-b693-274622380c6b","created":"2026-09-10T07:01:43.000Z","modified":"2026-09-15T22:19:18.415Z","created_by_ref":"identity--91f4ec79-59a0-4995-ba51-b1a09b5bbd8c","name":"sha1: d182eb7cba0ffa42d770d7b0d3499e49f24163a2","description":"Seen in \"Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.\" (GBHackers). Context: om.utils.Launcher Ad-hoc signature bundle identifier CDHash d182eb7cba0ffa42d770d7b0d3499e49f24163a2 Code Directory Hash Note: IP addresses and domains are inte","pattern":"[file:hashes.'SHA-1' = 'd182eb7cba0ffa42d770d7b0d3499e49f24163a2']","pattern_type":"stix","valid_from":"2026-09-10T07:01:43.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/clickfix-lures-target-macos/"}]}]}