Indicators of compromise
1,325 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use
| Type | Indicator | Context | Article | First seen |
|---|---|---|---|---|
| sha256 | 27e072b92b5ac9e3e2a6770bef3e84bdf864b0611d3bc9caca12be2b1a63dae4 | com BloodAlchemy-related railway-themed domain SHA-256 Hash 27E072B92B5AC9E3E2A6770BEF3E84BDF864B0611D3BC9CACA12BE2B1A63DAE4 SHA-256 fingerprint of the spoofed railway certificate SHA- | SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia Cyber Security News | · 4m ago |
| sha256 | e9d0e8b8a33858a7a5a46f78d7a78f9aa7f9b029348d9b618c6a6a1937a39382 | orical resolution for manager.skycom[.]support SHA-256 Hash E9D0E8B8A33858A7A5A46F78D7A78F9AA7F9B029348D9B618C6A6A1937A39382 Hash of the copied RTX Corporation web page IP Address 185. | SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia Cyber Security News | · 4m ago |
| sha256 | 05bbeea42f481a3dd1b3f670aba481f7c5c8e897ef321d65188317be5a65a4d7 | f1553035f22356ccf4 Ad4afe86a835bb2f7768862d358ebd8324c05902 05bbeea42f481a3dd1b3f670aba481f7c5c8e897ef321d65188317be5a65a4d7 Automata-20.zip, ZIP archive containing RUSTYMOVE File hash | APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks Cyber Security News | · 2h ago |
| sha256 | 0e134b72aad30d938043df8f2d674e56b4c57399a27311759a9e88f4c41c19e5 | db5f801194896f50896761ebdf DXSCAN compiled C2 build SHA-256 0e134b72aad30d938043df8f2d674e56b4c57399a27311759a9e88f4c41c19e5 DXSCAN debug build SHA-256 92dc24c9abc5baf7f2924c1872b14e74 | BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials Cyber Security News | · 2h ago |
| sha256 | 48330848eb742161f86129735333f10bd0d7b4db5f801194896f50896761ebdf | -controlled number used in bank-impersonation calls SHA-256 48330848eb742161f86129735333f10bd0d7b4db5f801194896f50896761ebdf DXSCAN compiled C2 build SHA-256 0e134b72aad30d938043df8f2d | BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials Cyber Security News | · 2h ago |
| sha256 | 8082a62e976c513605fd1d6b0c0e15eb127e40ab6ea3a902080be526155380c3 | 869ad159ec5d119a3aa02ca1f Related compiled C2 build SHA-256 8082a62e976c513605fd1d6b0c0e15eb127e40ab6ea3a902080be526155380c3 DXSCAN backup build SHA-256 8c12f1b013f6d68121b76f4ef65c294 | BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials Cyber Security News | · 2h ago |
| sha256 | 8c12f1b013f6d68121b76f4ef65c294273ab69151502d07ebef85994d656e5c9 | 27e40ab6ea3a902080be526155380c3 DXSCAN backup build SHA-256 8c12f1b013f6d68121b76f4ef65c294273ab69151502d07ebef85994d656e5c9 DXSCAN backup build SHA-256 db94077fcbcf030acff05334c5c0d15 | BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials Cyber Security News | · 2h ago |
| sha256 | 92dc24c9abc5baf7f2924c1872b14e747f600f5869ad159ec5d119a3aa02ca1f | b4c57399a27311759a9e88f4c41c19e5 DXSCAN debug build SHA-256 92dc24c9abc5baf7f2924c1872b14e747f600f5869ad159ec5d119a3aa02ca1f Related compiled C2 build SHA-256 8082a62e976c513605fd1d6b0 | BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials Cyber Security News | · 2h ago |
| sha256 | c0bb940a65ed234d0250edc8c4c4062a3d404a87d17dc01da38890a5ba74bce8 | af24f6c5747c3600652e9baf4c0 Newer compiled C2 build SHA-256 c0bb940a65ed234d0250edc8c4c4062a3d404a87d17dc01da38890a5ba74bce8 Previous compiled C2 build Weaponized CVEs CVE-2021-3129 ; | BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials Cyber Security News | · 2h ago |
| sha256 | db94077fcbcf030acff05334c5c0d153b8af6af24f6c5747c3600652e9baf4c0 | 3ab69151502d07ebef85994d656e5c9 DXSCAN backup build SHA-256 db94077fcbcf030acff05334c5c0d153b8af6af24f6c5747c3600652e9baf4c0 Newer compiled C2 build SHA-256 c0bb940a65ed234d0250edc8c4c | BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials Cyber Security News | · 2h ago |
| sha256 | b5ea87c2ddac3aa141bc6794b8993d1e43bd064eaae591719612becea0d106d7 | okonlinevault[.]com/scanna/200e61bfe54c92fb720c77c3a1661bc0/b5ea87c2ddac3aa141bc6794b8993d1e43bd064eaae591719612becea0d106d7 Decrypted relay URL used for tracking, filtering, and redir | GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds Cyber Security News | · 21h ago |
| sha256 | 3ab56c9fb6b7c404c1e5b36788959c877ea819fb124c3847fa0498e9915ef9a7 | dac7c2bcc0904f066e0de VectraRAT-related sample hash SHA-256 3ab56c9fb6b7c404c1e5b36788959c877ea819fb124c3847fa0498e9915ef9a7 VectraRAT-related sample hash SHA-256 7b82f08120e0d9b16cd5b | Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs Cyber Security News | · 21h ago |
| sha256 | 7b82f08120e0d9b16cd5b9ec59d24fb68e35735c82311a233d370e7f264af650 | c3847fa0498e9915ef9a7 VectraRAT-related sample hash SHA-256 7b82f08120e0d9b16cd5b9ec59d24fb68e35735c82311a233d370e7f264af650 VectraRAT-related sample hash SHA-256 b738c03fef5e3d26419e4 | Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs Cyber Security News | · 21h ago |
| sha256 | 8745e872ff8aa41b0e03737f76bf35b6c934106c987dff98afe34120e47caf91 | 9ba4113f47bf2c9244dc5 VectraRAT-related sample hash SHA-256 8745e872ff8aa41b0e03737f76bf35b6c934106c987dff98afe34120e47caf91 VectraRAT-related sample hash SHA-256 bba58f99e14e3512c04a5 | Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs Cyber Security News | · 21h ago |
| sha256 | b738c03fef5e3d26419e4aab1818a0a7ad206c67fb3eeedcdfb3ef1ee07eb620 | 11a233d370e7f264af650 VectraRAT-related sample hash SHA-256 b738c03fef5e3d26419e4aab1818a0a7ad206c67fb3eeedcdfb3ef1ee07eb620 VectraRAT-related sample hash IP address 86.109.75.168 Prim | Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs Cyber Security News | · 21h ago |
| sha256 | b926cfcd3f4b07fe6001c39f46e40225ff8000411198d13782538d770c54ae5e | d37b3377ae7b9acdcd0c9 VectraRAT-related sample hash SHA-256 b926cfcd3f4b07fe6001c39f46e40225ff8000411198d13782538d770c54ae5e VectraRAT-related sample hash SHA-256 bff3583d04f0d5603ced9 | Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs Cyber Security News | · 21h ago |
| sha256 | bba58f99e14e3512c04a5a74a079d7851abf935dd258cff4c80874ce7cfc82e3 | dff98afe34120e47caf91 VectraRAT-related sample hash SHA-256 bba58f99e14e3512c04a5a74a079d7851abf935dd258cff4c80874ce7cfc82e3 VectraRAT-related sample hash SHA-256 d8f15ba122cd6da01f83f | Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs Cyber Security News | · 21h ago |
| sha256 | bff3583d04f0d5603ced9831eb7c45c1923bd90e2f7d5e5d2b32942d38cf6dc5 | 8d13782538d770c54ae5e VectraRAT-related sample hash SHA-256 bff3583d04f0d5603ced9831eb7c45c1923bd90e2f7d5e5d2b32942d38cf6dc5 VectraRAT-related sample hash SHA-256 c708d413720848f8788f4 | Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs Cyber Security News | · 21h ago |
| sha256 | c708d413720848f8788f43a4f47ddce016fca9af10c9ba4113f47bf2c9244dc5 | d5e5d2b32942d38cf6dc5 VectraRAT-related sample hash SHA-256 c708d413720848f8788f43a4f47ddce016fca9af10c9ba4113f47bf2c9244dc5 VectraRAT-related sample hash SHA-256 8745e872ff8aa41b0e037 | Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs Cyber Security News | · 21h ago |
| sha256 | d8f15ba122cd6da01f83fe05294df80a6eadbce0f66dac7c2bcc0904f066e0de | 8cff4c80874ce7cfc82e3 VectraRAT-related sample hash SHA-256 d8f15ba122cd6da01f83fe05294df80a6eadbce0f66dac7c2bcc0904f066e0de VectraRAT-related sample hash SHA-256 3ab56c9fb6b7c404c1e5b | Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs Cyber Security News | · 21h ago |
| sha256 | ddbd636f6dfd475dc0c75bf9f6f873fa35b9062dee9d37b3377ae7b9acdcd0c9 | 25804fc4bc13f708d08ae VectraRAT-related sample hash SHA-256 ddbd636f6dfd475dc0c75bf9f6f873fa35b9062dee9d37b3377ae7b9acdcd0c9 VectraRAT-related sample hash SHA-256 b926cfcd3f4b07fe6001c | Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs Cyber Security News | · 21h ago |
| sha256 | dede8bfb55c2e6479d89b1e73e0712791cf16a7179325804fc4bc13f708d08ae | bd35eb7c35ae6b844a0f0 VectraRAT-related sample hash SHA-256 dede8bfb55c2e6479d89b1e73e0712791cf16a7179325804fc4bc13f708d08ae VectraRAT-related sample hash SHA-256 ddbd636f6dfd475dc0c75 | Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs Cyber Security News | · 21h ago |
| sha256 | e2db5db12564d2a9da7ef3a57aa23d95782f5eaddc8bd35eb7c35ae6b844a0f0 | s of Compromise (IoCs):- Type Indicator Description SHA-256 e2db5db12564d2a9da7ef3a57aa23d95782f5eaddc8bd35eb7c35ae6b844a0f0 VectraRAT-related sample hash SHA-256 dede8bfb55c2e6479d89b | Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs Cyber Security News | · 21h ago |
| sha256 | 33641bfbbdd5a9cd2320c61f65fe446a2226d8a48e3bd3c29e8f916f0592575f | f004486cd41efb Source-listed Noodle RAT sample hash SHA-256 33641bfbbdd5a9cd2320c61f65fe446a2226d8a48e3bd3c29e8f916f0592575f Source-listed Noodle RAT sample hash MD5 eff8675fac22c49107 | Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems Cyber Security News | · 22h ago |
| sha256 | 4f4d405d32d76a170ca2899c70b48ef6ffaaef792e024b6f8aab98d4ae55eae4 | b0a7f025f08250 Source-listed Noodle RAT sample hash SHA-256 4f4d405d32d76a170ca2899c70b48ef6ffaaef792e024b6f8aab98d4ae55eae4 Source-listed Noodle RAT sample hash MD5 f1a04ffaa889c11b99 | Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems Cyber Security News | · 22h ago |
| sha256 | 51aed28d3468de5e75addc467ba14389356afe896098e4e478efcd7bf79a65b9 | ba01a242f59327 Source-listed Noodle RAT sample hash SHA-256 51aed28d3468de5e75addc467ba14389356afe896098e4e478efcd7bf79a65b9 Source-listed Noodle RAT sample hash IPv4 Address 47.83.128 | Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems Cyber Security News | · 22h ago |
| sha256 | 668dcf124501c1767d4ebc19f29cb44d6474cbff28947d63a695628f467b6345 | 3beccc6fb927e2 Source-listed Noodle RAT sample hash SHA-256 668dcf124501c1767d4ebc19f29cb44d6474cbff28947d63a695628f467b6345 Source-listed Noodle RAT sample hash SHA-1 7436b37fae21f048 | Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems Cyber Security News | · 22h ago |
| sha256 | 7aa50ba59b38494cc524dbd31519bd3a218133aed64d9037eef02d697b8e99d0 | 2e52938460410b Source-listed Noodle RAT sample hash SHA-256 7aa50ba59b38494cc524dbd31519bd3a218133aed64d9037eef02d697b8e99d0 Source-listed Noodle RAT sample hash SHA-256 7b63ddaf3b217f | Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems Cyber Security News | · 22h ago |
| sha256 | 7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3 | f02d697b8e99d0 Source-listed Noodle RAT sample hash SHA-256 7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3 Source-listed Noodle RAT sample hash Note: IP addresses and | Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems Cyber Security News | · 22h ago |
| sha256 | 93b19bc56952ae1e82f1f41db49f455316736e2b8d161e64b115a150d8dcf204 | 853571d89209df Source-listed Noodle RAT sample hash SHA-256 93b19bc56952ae1e82f1f41db49f455316736e2b8d161e64b115a150d8dcf204 Source-listed Noodle RAT sample hash MD5 3c230061e5a16cc559 | Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems Cyber Security News | · 22h ago |
| sha256 | a7632f145e45c8d932f6f1a8ccbbf65e7ae97b0d339c45dfb548e29186db1144 | f1b0de9c0bb44b Source-listed Noodle RAT sample hash SHA-256 a7632f145e45c8d932f6f1a8ccbbf65e7ae97b0d339c45dfb548e29186db1144 Source-listed Noodle RAT sample hash SHA-256 abf83c4d6bbf50 | Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems Cyber Security News | · 22h ago |
| sha256 | abf83c4d6bbf508504398ac56031c566ed662c3cc7e7b490494d9ee72eece870 | 48e29186db1144 Source-listed Noodle RAT sample hash SHA-256 abf83c4d6bbf508504398ac56031c566ed662c3cc7e7b490494d9ee72eece870 Source-listed Noodle RAT sample hash MD5 26f33ae36ad0558239 | Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems Cyber Security News | · 22h ago |
| sha256 | bd113d6b2cfba5ab2780c313c01d87896c64f91376903efc62ba01a242f59327 | 14b44f623c650a Source-listed Noodle RAT sample hash SHA-256 bd113d6b2cfba5ab2780c313c01d87896c64f91376903efc62ba01a242f59327 Source-listed Noodle RAT sample hash SHA-256 51aed28d3468de | Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems Cyber Security News | · 22h ago |
| sha256 | df603ed55cbf6f9d74068b956ab966a7b785eb102e1045f343d96255eb2cdc24 | 728bf5d5c6ee71 Source-listed Noodle RAT sample hash SHA-256 df603ed55cbf6f9d74068b956ab966a7b785eb102e1045f343d96255eb2cdc24 Source-listed Noodle RAT sample hash SHA-1 d6b243db1dbca54d | Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems Cyber Security News | · 22h ago |
| sha256 | f25237d11c4d0aa0224d20b7a4f7815dc4971102d2584e991195d1dbc7b8d82d | adf827e0d0189d Source-listed Noodle RAT sample hash SHA-256 f25237d11c4d0aa0224d20b7a4f7815dc4971102d2584e991195d1dbc7b8d82d Source-listed Noodle RAT sample hash MD5 63af61806ff5060c77 | Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems Cyber Security News | · 22h ago |
| sha256 | 0c0e4935f8df04e86056798d417bf3f485c640fa0322756c0a860af2a6bd0f1d | 252ca5e7b7c7fe237 Related sample: Tax_436454367.img SHA-256 0c0e4935f8df04e86056798d417bf3f485c640fa0322756c0a860af2a6bd0f1d Related 2023 Chinese-language sample SHA-256 38ec1f5e23f65b | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | 268a90d07cf02b16c091ef6cc52e3dbe17638bb722221807bc833c4c1299a8a9 | b679a73c2 Related sample: ClientAny.exe / skkr3.exe SHA-256 268a90d07cf02b16c091ef6cc52e3dbe17638bb722221807bc833c4c1299a8a9 Related sample: Tax_Notice_16695 (1).img SHA-256 f23708ae47 | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | 2ff898c1a4bb0dd48687bbbc8cca646a896dc9ed24780a49523dfbf9fb94a4ec | e5a207315f7bf6ef74a966cbb5 libcurl.dll proxy loader SHA-256 2ff898c1a4bb0dd48687bbbc8cca646a896dc9ed24780a49523dfbf9fb94a4ec LIBCURL.DAT encrypted payload SHA-256 947221d0f1e2c9c090284 | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | 38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c | 860af2a6bd0f1d Related 2023 Chinese-language sample SHA-256 38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c Related sample: Tax_Notice_23665.img SHA-256 a4098fe9ed421a | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | 72a321802d738e8bc6a0ab9d9d24b380be944fffbfc85094b889690b679a73c2 | 321927fea66d Builder certificate SHA-256 thumbprint SHA-256 72a321802d738e8bc6a0ab9d9d24b380be944fffbfc85094b889690b679a73c2 Related sample: ClientAny.exe / skkr3.exe SHA-256 268a90d07 | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | 8c1ba078598e09294d72293a42dcd878e183b6e5a207315f7bf6ef74a966cbb5 | 8eb192583f950c Tax_Notice_45594.exe signed launcher SHA-256 8c1ba078598e09294d72293a42dcd878e183b6e5a207315f7bf6ef74a966cbb5 libcurl.dll proxy loader SHA-256 2ff898c1a4bb0dd48687bbbc8c | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | 947221d0f1e2c9c09028491997406dd9f0cb5b65258556c86d201ec1ca538f5f | 80a49523dfbf9fb94a4ec LIBCURL.DAT encrypted payload SHA-256 947221d0f1e2c9c09028491997406dd9f0cb5b65258556c86d201ec1ca538f5f stage2.dll VenomRAT .NET DLL Install directory %APPDATA%\Mi | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | a4098fe9ed421a6244c9fd4d3d1a632ff5f2ee4ffa204dff0587548932936d38 | 7e44e6a998e04c Related sample: Tax_Notice_23665.img SHA-256 a4098fe9ed421a6244c9fd4d3d1a632ff5f2ee4ffa204dff0587548932936d38 Related sample: Tax_Notice_99674.img Sister lure domain dgd | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | d768222934f6014bf17c3d0a1ef4c35e02aa6fe1e89564e252ca5e7b7c7fe237 | e4b10e65d0b08e3 Related sample: ITDENF2026-4281.img SHA-256 d768222934f6014bf17c3d0a1ef4c35e02aa6fe1e89564e252ca5e7b7c7fe237 Related sample: Tax_436454367.img SHA-256 0c0e4935f8df04e86 | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | f23708ae470904490cb25d370185ca89c0d37e33fa5a3c652e4b10e65d0b08e3 | 4c1299a8a9 Related sample: Tax_Notice_16695 (1).img SHA-256 f23708ae470904490cb25d370185ca89c0d37e33fa5a3c652e4b10e65d0b08e3 Related sample: ITDENF2026-4281.img SHA-256 d768222934f6014 | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | f72bf7c1fd132262715820d839e4874c97d927b10072fb4709a1321927fea66d | ociated with the modified v6.0.3 builder SHA-256 thumbprint f72bf7c1fd132262715820d839e4874c97d927b10072fb4709a1321927fea66d Builder certificate SHA-256 thumbprint SHA-256 72a321802d73 | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | f945b3f2f29d62099683cbbf069ed5bc952d089c16a85fb314ac8fe0f0c10d2b | {seq}} Unrendered variable in the From display name SHA-256 f945b3f2f29d62099683cbbf069ed5bc952d089c16a85fb314ac8fe0f0c10d2b Tax_Notice_45594.img ISO container SHA-256 fe0ddd8686324e0a | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | fe0ddd8686324e0a8b07ed5ffdb4f56397c70b1b5a19d2916c8eb192583f950c | 14ac8fe0f0c10d2b Tax_Notice_45594.img ISO container SHA-256 fe0ddd8686324e0a8b07ed5ffdb4f56397c70b1b5a19d2916c8eb192583f950c Tax_Notice_45594.exe signed launcher SHA-256 8c1ba078598e09 | PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks Cyber Security News | · 1d ago |
| sha256 | 4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9 | fection persistent on the infected macOS host SHA-256 hash: 4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9 File size: 568,368 bytes File location: /Users/[username]/L | Atomic macOS (AMOS) Stealer Activity Palo Alto Unit 42 | · 1d ago |
| sha256 | 608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688 | a Z-shell (Zsh) script from hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688 . That Zsh script contains Base64-encoded text for a GZIP-c | Atomic macOS (AMOS) Stealer Activity Palo Alto Unit 42 | · 1d ago |
| sha256 | 6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620 | fection persistent on the infected macOS host SHA-256 hash: 6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620 File size: 438,576 bytes File location: /Users/[username]/L | Atomic macOS (AMOS) Stealer Activity Palo Alto Unit 42 | · 1d ago |
| sha256 | 71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c | a command run from the macOS Terminal window SHA-256 hash: 71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c File size: 1,991 bytes File type: Zsh script text executabl | Atomic macOS (AMOS) Stealer Activity Palo Alto Unit 42 | · 1d ago |
| sha256 | 7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a | cted from the initially downloaded Zsh script SHA-256 hash: 7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a File size: 1,213 bytes File type: Zsh script text executabl | Atomic macOS (AMOS) Stealer Activity Palo Alto Unit 42 | · 1d ago |
| sha256 | a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9 | y long lines (323) Installer for AMOS stealer SHA-256 hash: a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9 File size: 330,768 bytes File location: /tmp/helper File ty | Atomic macOS (AMOS) Stealer Activity Palo Alto Unit 42 | · 1d ago |
| sha256 | 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 | s of compromise (IoCs):- Type Indicator Description SHA-256 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 KREMLIN JavaScript loader sample SHA-256 5ece7fd3766b0b7f8a | KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension Cyber Security News | · 1d ago |
| sha256 | 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c | 70e83abba66ee07bcecea0 Related Wave B loader sample SHA-256 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c Related Wave C loader sample SHA-256 42a3e2bb135fb46b11b127 | KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension Cyber Security News | · 1d ago |
| sha256 | 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca | 81bdd66a4268 KREMLIN x64 extension installer binary SHA-256 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca Malicious AVSync extension sample SHA-256 ba80216c960977fa4 | KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension Cyber Security News | · 1d ago |
| sha256 | 42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9 | fcb07739a10e4331e15a2c Related Wave C loader sample SHA-256 42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9 PowerShell extension-installer implementation Domain connec | KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension Cyber Security News | · 1d ago |
| sha256 | 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552 | aa75b2635cbdc0fa42 KREMLIN JavaScript loader sample SHA-256 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552 First-stage popup JavaScript sample SHA-256 c8c38634dd44d7c | KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension Cyber Security News | · 1d ago |
| sha256 | ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f | 3811930de66c3f7ca Malicious AVSync extension sample SHA-256 ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f Related Wave A loader sample SHA-256 cb15cbf3f01a92e609e4c2 | KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension Cyber Security News | · 1d ago |
| sha256 | c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268 | 89910e5be44f552 First-stage popup JavaScript sample SHA-256 c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268 KREMLIN x64 extension installer binary SHA-256 223be3f8648b | KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension Cyber Security News | · 1d ago |
| sha256 | cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0 | a737cbc0bf86e929c3be5f Related Wave A loader sample SHA-256 cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0 Related Wave B loader sample SHA-256 170dffb37e05f525f735bc | KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension Cyber Security News | · 1d ago |
| sha256 | 26166cd87ff07e7a50317a24126d14b262e842c5715585636dee3ab3f227ddca | tps://conversations-widget.brevo.com/brevo-conversations.js 26166cd87ff07e7a50317a24126d14b262e842c5715585636dee3ab3f227ddca clean, 72816 B 9b62c12bc5c7feb9802f58e6cf75a368690df3c754e3 | Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware Sansec (Magento / e-commerce security) | · 1d ago |
| sha256 | 4af488d79aef7daa12b1c18f0cce28b7edadccb8b6b0fb8d50d1d53a9a7c2df7 | sponse, identical across every host and every observed scan 4af488d79aef7daa12b1c18f0cce28b7edadccb8b6b0fb8d50d1d53a9a7c2df7 {"s":0,"r":"https:\/\/www.google.com"} # Do not block sendi | Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware Sansec (Magento / e-commerce security) | · 1d ago |
| sha256 | 58a5c601c9df7ca2120435588fc39f97712d9b878795f6ee500590099a432308 | 71db2c749fcc24a5bec3875f3654042169fb2418aed09 clean, 3442 B 58a5c601c9df7ca2120435588fc39f97712d9b878795f6ee500590099a432308 injected -> cdn2 f67d572d2d30407b3f470904326411450763108980 | Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware Sansec (Magento / e-commerce security) | · 1d ago |
| sha256 | 9b62c12bc5c7feb9802f58e6cf75a368690df3c754e37cc64483a92acacf87a5 | 7a24126d14b262e842c5715585636dee3ab3f227ddca clean, 72816 B 9b62c12bc5c7feb9802f58e6cf75a368690df3c754e37cc64483a92acacf87a5 injected -> cdn4 # The appended line (final line of each fi | Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware Sansec (Magento / e-commerce security) | · 1d ago |
| sha256 | f67d572d2d30407b3f470904326411450763108980cdad89550fbb221fb06782 | 588fc39f97712d9b878795f6ee500590099a432308 injected -> cdn2 f67d572d2d30407b3f470904326411450763108980cdad89550fbb221fb06782 injected -> cdn11 https://conversations-widget.brevo.com/br | Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware Sansec (Magento / e-commerce security) | · 1d ago |
| sha256 | fe8447fd1ec4dca652b71db2c749fcc24a5bec3875f3654042169fb2418aed09 | e 15 September 2026) https://cdn.brevo.com/js/sdk-loader.js fe8447fd1ec4dca652b71db2c749fcc24a5bec3875f3654042169fb2418aed09 clean, 3442 B 58a5c601c9df7ca2120435588fc39f97712d9b878795f | Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware Sansec (Magento / e-commerce security) | · 1d ago |
| sha256 | 06a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b | cb92 SIC MP3/HTA payload and Talos clipper artifact SHA-256 06a3d3bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b; d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4 | b7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e; 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4; ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c287 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505 | 3c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540; 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505; 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938 | 9ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e51a7505; 249088420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938; 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e8 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 | 2365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7; 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 SIC MP3/HTA payload and Talos clipper artifact SHA-256 06a3 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24 | e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5; 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92541a24 InstallFix MP3/HTA, InstallFix /cl and recovered InstallFix | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5 | 83129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad; 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c891795dc2f5; 3276414afb3c7ce7aa19db5401051ce4ad6968a7cc6bf8384cd6470c92 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | 5e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad | ake Ledger, Trezor and Exodus application artifacts SHA-256 5e8ad983129f6771d186f60379dca30d208374cac45bac75d5459aaf0fabc8ad; 480c65e5bb793da2d5ddfdcf00dd37bd4c7176ea0fb58d4e6bd5c89179 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | 6759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7 | c218e1aba3fcb Recovered x86 artifact and Amatera PE SHA-256 6759c72365d0c690db613ff30635970668f5699b65c3842ecdc4f1b695ed13a7; 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | 93d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae | 41ef5d316a1ae8631329349287e6a411 Metadata artifacts SHA-256 93d986f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae; e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96 | 420058e50b5e7d1e615a6b9c212e1c341b43fbd8b60cde30d5bd281938; 9eb96fc1fda13b143a90896793754b6a61942dbf87846895bb9ea8c1e849cd96 Houston, Pressureulcerlawyer, Lalandscapelighting, Aidevmas | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411 | 711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7; a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287e6a411 Metadata artifacts SHA-256 93d986f39599df747e4f65484a41d5e5 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c | bdeb33411fba53eed53cf528f3b33fdf5c2a74921d5d98002cb5e2ba1b; d1690bec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c; ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | d4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2 | 949cfc514f145262136898b009 September macOS artifact SHA-256 d4150c1c97f047c6edb14767bf1efa8f9e37d63b124f38f27da4ef52d570aac2 AccountsHelper artifact SHA-256 f71d72711fe132f00d1a10d6f8c | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcb | b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331; d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1aba3fcb Recovered x86 artifact and Amatera PE SHA-256 6759c72365d0c | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540 | 506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7; d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b5a0540; 18c8b79ce68060782e52445a9f38c57e4b6e3f09f625b0465e0a9576e5 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6c | f39599df747e4f65484a41d5e5ae7ece345924ea36e4f4ee623ce2f0ae; e6e54a8e8f30cedd8492f515ab95e005478bafb41998c43341fcf3a494573d6c Arkypc loader and helper SHA-256 f8d09bb7ef38015342fb8ae11c | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331 | , InstallFix /cl and recovered InstallFix artifacts SHA-256 ec9111b13bb21c1ce757db666b6df329724ec2ec493bcae1ba64b4ec2e93a331; d4eb6e4cec1e69f3bc94bbe2d743e982863fc8549e49f832846c218e1a | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfb | 1301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f157aab4; ecbbf5c7f1fac026dbaa74e8dac630730b4a49fbbb9fd59c333c48c28768ebfb Fake Ledger, Trezor and Exodus application artifacts SHA-25 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7 | ec25ed5423e86a9ba1ce41ba8d0de91700e0b680291196dd9975a8a29c; ede6ea506c6221f24618f8a7177f9c2f16b63968f0c34818c45d88f1d0dd03a7; d95e123c2ed35a03b84558b8a3cd7b7e47a15914ed819ca2ce99afe32b | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009 | Selectors for getData() , balanceOf() and setData() SHA-256 eec09815c3664aa6b3cd370a8b8f566be3b804949cfc514f145262136898b009 September macOS artifact SHA-256 d4150c1c97f047c6edb14767bf | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7 | 63b124f38f27da4ef52d570aac2 AccountsHelper artifact SHA-256 f71d72711fe132f00d1a10d6f8c0f26c1544b41f57ca9262668dd2c771cc31f7; a90a93e9776852dac869d4097dba2a4741ef5d316a1ae8631329349287 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e | b41998c43341fcf3a494573d6c Arkypc loader and helper SHA-256 f8d09bb7ef38015342fb8ae11c489fc1a3f01e743123e4222e9291cb474fb75e; 131a071301006dbed8dbf4d2e08b2914407b7693ab23566bdfee9f39f1 | Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads Cyber Security News | · 2d ago |
| sha256 | 141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc | ple.com Twitch Enhanced Viewer Firefox Add-ons ID; SHA-256: 141c35607dc0e8e400deb380126b3052bd0495b4d37c8dd979c6aa0204b142fc Note: IP addresses and domains are intentionally defanged ( | Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users Cyber Security News | · 2d ago |
| sha256 | e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8 | ed Viewer | JeetBot Chrome Web Store extension ID; SHA-256: e17e1e671b597da19b89c5b2d0fa821e90e627860e756ae4947ed27c035330a8 Firefox extension [email protected] Twitch E | Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users Cyber Security News | · 2d ago |
| sha256 | 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 | RAYRABBIT command-and-control domain using port 443 SHA-256 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 Trojanized DLL loader, originally identified as 7zp.dll wit | One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users Cyber Security News | · 2d ago |
| sha256 | 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e | ly identified as 7zp.dll with internal name boy.dll SHA-256 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e Encrypted payload blob identified as p SHA-256 D7a3c7eb94ed | One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users Cyber Security News | · 2d ago |
| sha256 | d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a | 98662e02422e Encrypted payload blob identified as p SHA-256 D7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a GRAYRABBIT backdoor with internal name core.dll File name 7 | One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users Cyber Security News | · 2d ago |
| sha256 | 0849a6b87fbef25089ad0be746f84047b080ba81898a8614da43d4ab60ef735a | 1b17917e2e183a4bd9cbcb2ed77e Malicious PDF lure PDF SHA-256 0849a6b87fbef25089ad0be746f84047b080ba81898a8614da43d4ab60ef735a Malicious PDF lure Email SHA-256 debe871710268e7bb770b72c67 | Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites Cyber Security News | · 3d ago |
| sha256 | 0b4d962eef2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d99667616d5 | 659880e1a8a7b0a2dd851dc5e7a3 Malicious PDF lure PDF SHA-256 0b4d962eef2d06abfe08a8cd0b15edd224d4fae0b57d708aebd77d99667616d5 Malicious PDF lure PDF SHA-256 c521b3a189b0089a2558aa4e42bd | Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites Cyber Security News | · 3d ago |
| sha256 | 1b4d5c95f4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad8bc6fa8ed | 4a2145348b953b1d06e2eaf0bf2c Malicious PDF lure PDF SHA-256 1b4d5c95f4fc037ca3c359cea5ca2da1285bbadab12bcdcb47f3dad8bc6fa8ed Malicious PDF lure PDF SHA-256 62ef39ec29966d71c8254f68bd5e | Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites Cyber Security News | · 3d ago |
| sha256 | 1f1a89bef73e4866a198a08e750f96348ce2b82816a8353e9a8a574bfde5f491 | 042d76c12dbafdcc0766861827c5 Malicious PDF lure PDF SHA-256 1f1a89bef73e4866a198a08e750f96348ce2b82816a8353e9a8a574bfde5f491 Malicious PDF lure PDF SHA-256 ea8af591fe2d605c82bb7831d2eb | Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites Cyber Security News | · 3d ago |
Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.