FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10)
Fake-recruiter trojan distributed via taikotalent.xyz has been taken down after the registrar placed the domain on clientHold on October 10.
The campaign used fake 'Engineering opening - Taiko' recruitment emails that tricked victims into pasting a bash stager script ('deepfake_guard', 49,916 bytes, SHA-256 c7c22e322c...) into a terminal. The stager communicated with C2 server api.gaganata.ink, dropped a base64-encoded second stage to /var/tmp/.kdm.*, and performed anti-forensic self-deletion. The domain was suspended by registrar clientHold on 2026-10-10, resolving the campaign.
- Fake Taiko recruiter emails delivered paste-in-terminal bash stager
- C2 was api.gaganata.ink; second stage written to /var/tmp/.kdm.*
- Domain taikotalent.xyz placed on registrar clientHold on 2026-10-10
- Stager included anti-forensic self-deletion capabilities
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | taikotalent.xyz | Posted by eddyflores100 on Oct 15 Follow-up: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026 |
Posted by eddyflores100 on Oct 15 Follow-up: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) Summary for the list: the campaign previously disclosed here (fake "Engineering opening - Taiko" emails leading to a paste-in-terminal bash stager "deepfake_guard", 49,916 B, SHA-256 c7c22e322c..., C2 api.gaganata.ink, base64 second stage /var/tmp/.kdm.*, anti-forensic self-deletion) has been taken down. Timeline: - 2026-10-05:...
This source does not provide full text. Read it at seclists.org.