{
  "campaign_count": 22,
  "campaigns": [
    {
      "anchors": {
        "registered_domains": [
          "callmechina.co",
          "cleaningcompanyhenderson.com",
          "cliphotvn.blog",
          "clipsexsub.co.uk",
          "clipviet.blog",
          "geiku.co",
          "istanbulozelegitim.net",
          "liteapks.co.in",
          "menuphimsexhay.com",
          "phimsex365.com",
          "phimsexchaua.net",
          "phimsexso1.net",
          "phimsexvietsub18.net",
          "phimtoico.blog",
          "prettylittleplumbs.com",
          "redlionouston.co.uk",
          "rfccarparkmanagement.co.uk",
          "sexdamvcl.net",
          "sextop1jav.com",
          "sextop1s.com",
          "sextructuyen.com",
          "topsexhd.net",
          "tubetune.co",
          "vlxxyz.net",
          "xamsex.com"
        ],
        "tags": [
          "#AsyncRAT"
        ],
        "url_path_patterns": []
      },
      "confidence": "medium",
      "context": "A large AsyncRAT command-and-control deployment uses a broad mix of Vietnamese adult content sites (phimsexso1.net, menuphimsexhay.com, phimsexvietsub18.net), generic consumer websites, and unrelated businesses as relay infrastructure alongside bare IPs including 109.123.236.85. The spread across unrelated domain categories suggests mass-compromise or shared-hosting abuse rather than purpose-registered infrastructure. Seventy-one IOCs including 29 domains, 3 IPs, and 39 URLs were reported by one researcher between July 1 and 2.",
      "first_seen": "2026-07-01",
      "id": "tfc-f3d2bbd121f7",
      "ioc_count": 71,
      "iocs": [
        {
          "date": "2026-07-02 10:29:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072628617138368751",
          "type": "domain",
          "user": "skocherhan",
          "value": "istanbulozelegitim.net"
        },
        {
          "date": "2026-07-02 10:29:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072628617138368751",
          "type": "url",
          "user": "skocherhan",
          "value": "http://istanbulozelegitim.net"
        },
        {
          "date": "2026-07-02 10:29:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072628617138368751",
          "type": "url",
          "user": "skocherhan",
          "value": "http://172.67.131.189:8080"
        },
        {
          "date": "2026-07-02 10:29:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072628617138368751",
          "type": "url",
          "user": "skocherhan",
          "value": "http://172.67.131.189:22"
        },
        {
          "date": "2026-07-02 10:29:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072628617138368751",
          "type": "url",
          "user": "skocherhan",
          "value": "http://104.21.10.244:8880"
        },
        {
          "date": "2026-07-02 10:29:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072628617138368751",
          "type": "url",
          "user": "skocherhan",
          "value": "http://104.21.10.244:2082"
        },
        {
          "date": "2026-07-02 10:20:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072626384162197562",
          "type": "url",
          "user": "skocherhan",
          "value": "http://cleaningcompanyhenderson.com"
        },
        {
          "date": "2026-07-02 10:20:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072626384162197562",
          "type": "url",
          "user": "skocherhan",
          "value": "http://172.67.163.114"
        },
        {
          "date": "2026-07-02 10:20:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072626384162197562",
          "type": "url",
          "user": "skocherhan",
          "value": "http://104.21.58.193"
        },
        {
          "date": "2026-07-02 10:20:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072626384162197562",
          "type": "domain",
          "user": "skocherhan",
          "value": "cleaningcompanyhenderson.com"
        },
        {
          "date": "2026-07-02 08:11:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072594083634196930",
          "type": "domain",
          "user": "skocherhan",
          "value": "prettylittleplumbs.com"
        },
        {
          "date": "2026-07-02 08:11:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072594083634196930",
          "type": "url",
          "user": "skocherhan",
          "value": "http://prettylittleplumbs.com"
        },
        {
          "date": "2026-07-02 08:11:00",
          "tags": [
            "#AsyncRAT"
          ],
          "tweet": "https://x.com/skocherhan/status/2072594083634196930",
          "type": "url",
          "user": "skocherhan",
          "value": "http://104.21.6.101"
        },
        {
          "date": "2026-07-02 07:55:00",
          "tags": [
            "#AsyncRAT",
            "#C2"
          ],
          "tweet": "https://x.com/skocherhan/status/2072590041600188498",
          "type": "domain",
          "user": "skocherhan",
          "value": "z.phimtoico.blog"
        },
        {
          "date": "2026-07-02 07:55:00",
          "tags": [
            "#AsyncRAT",
            "#C2"
          ],
          "tweet": "https://x.com/skocherhan/status/2072590041600188498",
          "type": "domain",
          "user": "skocherhan",
          "value": "x.phimtoico.blog"
        },
        {
          "date": "2026-07-02 07:55:00",
          "tags": [
            "#AsyncRAT",
            "#C2"
          ],
          "tweet": "https://x.com/skocherhan/status/2072590041600188498",
          "type": "domain",
          "user": "skocherhan",
          "value": "x.clipviet.blog"
        },
        {
          "date": "2026-07-02 07:55:00",
          "tags": [
            "#AsyncRAT",
            "#C2"
          ],
          "tweet": "https://x.com/skocherhan/status/2072590041600188498",
          "type": "domain",
          "user": "skocherhan",
          "value": "x.clipsexsub.co.uk"
        },
        {
          "date": "2026-07-02 07:55:00",
          "tags": [
            "#AsyncRAT",
            "#C2"
          ],
          "tweet": "https://x.com/skocherhan/status/2072590041600188498",
          "type": "domain",
          "user": "skocherhan",
          "value": "phimtoico.blog"
        },
        {
          "date": "2026-07-02 07:55:00",
          "tags": [
            "#AsyncRAT",
            "#C2"
          ],
          "tweet": "https://x.com/skocherhan/status/2072590041600188498",
          "type": "url",
          "user": "skocherhan",
          "value": "http://z.phimtoico.blog"
        },
        {
          "date": "2026-07-02 07:55:00",
          "tags": [
            "#AsyncRAT",
            "#C2"
          ],
          "tweet": "https://x.com/skocherhan/status/2072590041600188498",
          "type": "url",
          "user": "skocherhan",
          "value": "http://x.phimtoico.blog"
        },
        {
          "date": "2026-07-02 07:55:00",
          "tags": [
            "#AsyncRAT",
            "#C2"
          ],
          "tweet": "https://x.com/skocherhan/status/2072590041600188498",
          "type": "url",
          "user": "skocherhan",
          "value": "http://x.clipviet.blog"
        },
        {
          "date": "2026-07-02 07:55:00",
          "tags": [
            "#AsyncRAT",
            "#C2"
          ],
          "tweet": "https://x.com/skocherhan/status/2072590041600188498",
          "type": "url",
          "user": "skocherhan",
          "value": "http://x.clipsexsub.co.uk"
        },
        {
          "date": "2026-07-02 07:55:00",
          "tags": [
            "#AsyncRAT",
            "#C2"
          ],
          "tweet": "https://x.com/skocherhan/status/2072590041600188498",
          "type": "url",
          "user": "skocherhan",
          "value": "http://phimtoico.blog"
        },
        {
          "date": "2026-07-02 07:55:00",
          "tags": [
            "#AsyncRAT",
            "#C2"
          ],
          "tweet": "https://x.com/skocherhan/status/2072590041600188498",
          "type": "url",
          "user": "skocherhan",
          "value": "http://clipviet.blog"
        },
        {
          "date": "2026-07-02 07:55:00",
          "tags": [
            "#AsyncRAT",
            "#C2"
          ],
          "tweet": "https://x.com/skocherhan/status/2072590041600188498",
          "type": "url",
          "user": "skocherhan",
          "value": "http://clipsexsub.co.uk"
        }
      ],
      "last_seen": "2026-07-02",
      "member_cluster_ids": [
        "tfc-f3d2bbd121f7"
      ],
      "name": "AsyncRAT C2 on adult content and compromised domains",
      "reporters": [
        "skocherhan"
      ],
      "tags": [
        "#AsyncRAT",
        "#C2"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 29,
        "ip": 3,
        "url": 39
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "3701048.xyz",
          "axdyka.info",
          "basefile.click",
          "benvanhunen.nl",
          "bestitemnest.shop",
          "claimbtc.com",
          "dasuannet.com",
          "divineclosetkc.org",
          "galactustcg.com",
          "gestionlocativepro.fr",
          "kaverimetalalloys.com",
          "nfld5.click",
          "qbravqfh.xyz",
          "qz8ueo0.cn",
          "rixasmizebibm.pro",
          "sbeomv.com",
          "sentinelcore.sbs",
          "slabx.uk",
          "smarte3info.fr",
          "sotradis.ma",
          "stelu.life",
          "stone-riser6.ru.com",
          "wowph16.life",
          "wq711.com",
          "xxxread.store"
        ],
        "tags": [
          "#Formbook"
        ],
        "url_path_patterns": [
          "/NgtN",
          "/NoqN",
          "/Nuvi",
          "/Nwon",
          "/aNlr",
          "/aNoc",
          "/ayNy",
          "/bbzN",
          "/bfNm",
          "/cjwv",
          "/etNc",
          "/hjfi",
          "/hzfo",
          "/ihNu",
          "/kNqN",
          "/mrdn",
          "/oNpt",
          "/qNml",
          "/qgrl",
          "/qtNb",
          "/rzbk",
          "/uiNo",
          "/xeyy"
        ]
      },
      "confidence": "medium",
      "context": "A Formbook infostealer campaign communicating with 25 C2 domains via short 4-character URL path patterns (e.g., /rzbk/, /mrdn/, /hjfi/) that are characteristic of Formbook's gate request format. Domains span multiple TLDs including .xyz, .fr, .shop, .nl, and .ma, mixing newly registered sites with apparent compromised legitimate ones. Fifty-three IOCs were reported by one researcher between July 2 and 3.",
      "first_seen": "2026-07-02",
      "id": "tfc-4579b2bac2d7",
      "ioc_count": 53,
      "iocs": [
        {
          "date": "2026-07-03 18:13:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2073107789296111873",
          "type": "url",
          "user": "skocherhan",
          "value": "http://basefile.click"
        },
        {
          "date": "2026-07-03 18:13:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2073107789296111873",
          "type": "domain",
          "user": "skocherhan",
          "value": "basefile.click"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "domain",
          "user": "skocherhan",
          "value": "xxxread.store"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "domain",
          "user": "skocherhan",
          "value": "wq711.com"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "domain",
          "user": "skocherhan",
          "value": "wowph16.life"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "domain",
          "user": "skocherhan",
          "value": "stone-riser6.ru.com"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "domain",
          "user": "skocherhan",
          "value": "sotradis.ma"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "domain",
          "user": "skocherhan",
          "value": "slabx.uk"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "domain",
          "user": "skocherhan",
          "value": "sbeomv.com"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "domain",
          "user": "skocherhan",
          "value": "rixasmizebibm.pro"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "domain",
          "user": "skocherhan",
          "value": "qz8ueo0.cn"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "domain",
          "user": "skocherhan",
          "value": "nfld5.click"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "domain",
          "user": "skocherhan",
          "value": "kaverimetalalloys.com"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "url",
          "user": "skocherhan",
          "value": "http://www.xxxread.store/5won/"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "url",
          "user": "skocherhan",
          "value": "http://www.wq711.com/ay3y/"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "url",
          "user": "skocherhan",
          "value": "http://www.wowph16.life/a3lr/"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "url",
          "user": "skocherhan",
          "value": "http://www.stone-riser6.ru.com/bbz3/"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "url",
          "user": "skocherhan",
          "value": "http://www.sotradis.ma/5oq1/"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "url",
          "user": "skocherhan",
          "value": "http://www.slabx.uk/a5oc/"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "url",
          "user": "skocherhan",
          "value": "http://www.sbeomv.com/hzfo/"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "url",
          "user": "skocherhan",
          "value": "http://www.rixasmizebibm.pro/61dx/"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "url",
          "user": "skocherhan",
          "value": "http://www.qz8ueo0.cn/8gt7/"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "url",
          "user": "skocherhan",
          "value": "http://www.nfld5.click/hjfi/"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "url",
          "user": "skocherhan",
          "value": "http://www.kaverimetalalloys.com/et5c/"
        },
        {
          "date": "2026-07-02 09:31:00",
          "tags": [
            "#Formbook"
          ],
          "tweet": "https://x.com/skocherhan/status/2072614170302832744",
          "type": "url",
          "user": "skocherhan",
          "value": "http://www.claimbtc.com/qgrl/"
        }
      ],
      "last_seen": "2026-07-03",
      "member_cluster_ids": [
        "tfc-4579b2bac2d7"
      ],
      "name": "Formbook C2 wave on mixed-TLD domains",
      "reporters": [
        "skocherhan"
      ],
      "tags": [
        "#Formbook"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 25,
        "url": 28
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "aktwz.com",
          "edge-msdn.com",
          "excitinggamesandfun.com",
          "sanshitangedu.com",
          "takermore.com",
          "thepsychictreeshop.com",
          "venconn.com",
          "zh-cn-sina.com"
        ],
        "tags": [],
        "url_path_patterns": [
          "/login"
        ]
      },
      "confidence": "medium",
      "context": "A phishing campaign impersonating Japanese consumer brands by placing brand-name subdomains on compromised or attacker-registered domains and directing victims to /login credential harvesting pages. Subdomains observed include rakuten-bank.takermore.com, my-docomo.aktwz.com, and my-jiepoint.sanshitangedu.com, targeting Rakuten Bank, NTT docomo, and Japanese digital payment services. Two researchers reported 16 IOCs between July 2 and 4.",
      "first_seen": "2026-07-02",
      "id": "tfc-8b0b77cc6449",
      "ioc_count": 16,
      "iocs": [
        {
          "date": "2026-07-04 14:00:00",
          "tags": [
            "#malware"
          ],
          "tweet": "https://x.com/ViriBack/status/2073406707741470800",
          "type": "domain",
          "user": "ViriBack",
          "value": "panel.edge-msdn.com"
        },
        {
          "date": "2026-07-04 14:00:00",
          "tags": [
            "#malware"
          ],
          "tweet": "https://x.com/ViriBack/status/2073406707741470800",
          "type": "url",
          "user": "ViriBack",
          "value": "http://panel.edge-msdn.com/login"
        },
        {
          "date": "2026-07-03 08:52:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072966645530906906",
          "type": "domain",
          "user": "masaomi346",
          "value": "venconn.com"
        },
        {
          "date": "2026-07-03 08:52:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072966645530906906",
          "type": "url",
          "user": "masaomi346",
          "value": "https://venconn.com/login"
        },
        {
          "date": "2026-07-03 07:49:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072950936105087334",
          "type": "domain",
          "user": "masaomi346",
          "value": "zh-cn-sina.com"
        },
        {
          "date": "2026-07-03 07:49:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072950936105087334",
          "type": "url",
          "user": "masaomi346",
          "value": "https://zh-cn-sina.com/login"
        },
        {
          "date": "2026-07-03 02:25:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072869407215559010",
          "type": "domain",
          "user": "masaomi346",
          "value": "my-docomo.excitinggamesandfun.com"
        },
        {
          "date": "2026-07-03 02:25:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072869407215559010",
          "type": "domain",
          "user": "masaomi346",
          "value": "my-docomo.aktwz.com"
        },
        {
          "date": "2026-07-03 02:25:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072869407215559010",
          "type": "url",
          "user": "masaomi346",
          "value": "https://my-docomo.excitinggamesandfun.com/login"
        },
        {
          "date": "2026-07-03 02:25:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072869407215559010",
          "type": "url",
          "user": "masaomi346",
          "value": "https://my-docomo.aktwz.com/login"
        },
        {
          "date": "2026-07-02 10:30:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072629007443755383",
          "type": "domain",
          "user": "masaomi346",
          "value": "rakuten-bank.thepsychictreeshop.com"
        },
        {
          "date": "2026-07-02 10:30:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072629007443755383",
          "type": "domain",
          "user": "masaomi346",
          "value": "rakuten-bank.takermore.com"
        },
        {
          "date": "2026-07-02 10:30:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072629007443755383",
          "type": "url",
          "user": "masaomi346",
          "value": "https://rakuten-bank.thepsychictreeshop.com/login"
        },
        {
          "date": "2026-07-02 10:30:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072629007443755383",
          "type": "url",
          "user": "masaomi346",
          "value": "https://rakuten-bank.takermore.com/login"
        },
        {
          "date": "2026-07-02 08:38:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072600850661515269",
          "type": "domain",
          "user": "masaomi346",
          "value": "my-jiepoint.sanshitangedu.com"
        },
        {
          "date": "2026-07-02 08:38:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/masaomi346/status/2072600850661515269",
          "type": "url",
          "user": "masaomi346",
          "value": "https://my-jiepoint.sanshitangedu.com/login"
        }
      ],
      "last_seen": "2026-07-04",
      "member_cluster_ids": [
        "tfc-8b0b77cc6449"
      ],
      "name": "Japanese consumer phishing: Rakuten Bank, docomo",
      "reporters": [
        "ViriBack",
        "masaomi346"
      ],
      "tags": [
        "#malware",
        "#phishing"
      ],
      "targeted_brand": "Rakuten Bank",
      "types": {
        "domain": 8,
        "url": 8
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "getmaccy.app",
          "macos-wallspace.com",
          "macos-wallspace.net"
        ],
        "tags": [],
        "url_path_patterns": []
      },
      "confidence": "low",
      "context": "A cluster of macOS-themed phishing or malware delivery sites registered on July 3 and reported by the same researcher: macos-wallspace.net, macos-wallspace.com (the same brand name across two TLDs), and getmaccy.app (typosquatting a legitimate macOS clipboard manager, Maccy). Each domain hosts active subdomains (gx.*, gp.*, xo.*) consistent with a tiered delivery infrastructure. Twelve IOCs across three domains were reported by one researcher on July 3.",
      "first_seen": "2026-07-03",
      "id": "tfc-5c68dcf77e30",
      "ioc_count": 12,
      "iocs": [
        {
          "date": "2026-07-03 17:56:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2073103648503005289",
          "type": "domain",
          "user": "skocherhan",
          "value": "xo.getmaccy.app"
        },
        {
          "date": "2026-07-03 17:56:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2073103648503005289",
          "type": "domain",
          "user": "skocherhan",
          "value": "macos-wallspace.net"
        },
        {
          "date": "2026-07-03 17:56:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2073103648503005289",
          "type": "domain",
          "user": "skocherhan",
          "value": "macos-wallspace.com"
        },
        {
          "date": "2026-07-03 17:56:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2073103648503005289",
          "type": "url",
          "user": "skocherhan",
          "value": "http://xo.getmaccy.app"
        },
        {
          "date": "2026-07-03 17:56:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2073103648503005289",
          "type": "url",
          "user": "skocherhan",
          "value": "http://macos-wallspace.net"
        },
        {
          "date": "2026-07-03 17:56:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2073103648503005289",
          "type": "url",
          "user": "skocherhan",
          "value": "http://macos-wallspace.com"
        },
        {
          "date": "2026-07-03 17:56:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2073103648503005289",
          "type": "url",
          "user": "skocherhan",
          "value": "http://gx.macos-wallspace.net"
        },
        {
          "date": "2026-07-03 17:56:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2073103648503005289",
          "type": "url",
          "user": "skocherhan",
          "value": "http://gp.macos-wallspace.com"
        },
        {
          "date": "2026-07-03 17:56:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2073103648503005289",
          "type": "url",
          "user": "skocherhan",
          "value": "http://getmaccy.app"
        },
        {
          "date": "2026-07-03 17:56:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2073103648503005289",
          "type": "domain",
          "user": "skocherhan",
          "value": "gx.macos-wallspace.net"
        },
        {
          "date": "2026-07-03 17:56:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2073103648503005289",
          "type": "domain",
          "user": "skocherhan",
          "value": "gp.macos-wallspace.com"
        },
        {
          "date": "2026-07-03 17:56:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2073103648503005289",
          "type": "domain",
          "user": "skocherhan",
          "value": "getmaccy.app"
        }
      ],
      "last_seen": "2026-07-03",
      "member_cluster_ids": [
        "tfc-5c68dcf77e30",
        "tfc-c2c572c7d148",
        "tfc-f76903eb659a"
      ],
      "name": "macOS-themed phishing on macos-wallspace and getmaccy.app",
      "reporters": [
        "skocherhan"
      ],
      "tags": [
        "#phishing"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 6,
        "url": 6
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "alphastand.top",
          "alphastand.trade",
          "alphastand.win",
          "kbfvzoboss.bid",
          "svmarketingindia.com"
        ],
        "tags": [
          "#Lokibot"
        ],
        "url_path_patterns": [
          "/alien/fre.php",
          "/wpN/fre.php"
        ]
      },
      "confidence": "high",
      "context": "A Lokibot credential-stealer campaign using a cluster of alphastand.* domains registered across three TLDs (.top, .trade, .win) alongside kbfvzoboss.bid and a compromised WordPress site. All C2 endpoints use the standard Lokibot path /alien/fre.php or /wp<id>/fre.php. Eleven IOCs were reported by one researcher on July 2.",
      "first_seen": "2026-07-02",
      "id": "tfc-e5b08e24a9bf",
      "ioc_count": 11,
      "iocs": [
        {
          "date": "2026-07-02 16:27:00",
          "tags": [
            "#Lokibot"
          ],
          "tweet": "https://x.com/skocherhan/status/2072718925628907722",
          "type": "domain",
          "user": "skocherhan",
          "value": "svmarketingindia.com"
        },
        {
          "date": "2026-07-02 16:27:00",
          "tags": [
            "#Lokibot"
          ],
          "tweet": "https://x.com/skocherhan/status/2072718925628907722",
          "type": "domain",
          "user": "skocherhan",
          "value": "kbfvzoboss.bid"
        },
        {
          "date": "2026-07-02 16:27:00",
          "tags": [
            "#Lokibot"
          ],
          "tweet": "https://x.com/skocherhan/status/2072718925628907722",
          "type": "url",
          "user": "skocherhan",
          "value": "http://svmarketingindia.com/wp169/fre.php"
        },
        {
          "date": "2026-07-02 16:27:00",
          "tags": [
            "#Lokibot"
          ],
          "tweet": "https://x.com/skocherhan/status/2072718925628907722",
          "type": "url",
          "user": "skocherhan",
          "value": "http://kbfvzoboss.bid/alien/fre.php"
        },
        {
          "date": "2026-07-02 16:27:00",
          "tags": [
            "#Lokibot"
          ],
          "tweet": "https://x.com/skocherhan/status/2072718925628907722",
          "type": "url",
          "user": "skocherhan",
          "value": "http://alphastand.win/alien/fre.php"
        },
        {
          "date": "2026-07-02 16:27:00",
          "tags": [
            "#Lokibot"
          ],
          "tweet": "https://x.com/skocherhan/status/2072718925628907722",
          "type": "url",
          "user": "skocherhan",
          "value": "http://alphastand.trade/alien/fre.php"
        },
        {
          "date": "2026-07-02 16:27:00",
          "tags": [
            "#Lokibot"
          ],
          "tweet": "https://x.com/skocherhan/status/2072718925628907722",
          "type": "url",
          "user": "skocherhan",
          "value": "http://alphastand.top/alien/fre.php"
        },
        {
          "date": "2026-07-02 16:27:00",
          "tags": [
            "#Lokibot"
          ],
          "tweet": "https://x.com/skocherhan/status/2072718925628907722",
          "type": "domain",
          "user": "skocherhan",
          "value": "alphastand.win"
        },
        {
          "date": "2026-07-02 16:27:00",
          "tags": [
            "#Lokibot"
          ],
          "tweet": "https://x.com/skocherhan/status/2072718925628907722",
          "type": "domain",
          "user": "skocherhan",
          "value": "alphastand.trade"
        },
        {
          "date": "2026-07-02 16:27:00",
          "tags": [
            "#Lokibot"
          ],
          "tweet": "https://x.com/skocherhan/status/2072718925628907722",
          "type": "domain",
          "user": "skocherhan",
          "value": "alphastand.top"
        },
        {
          "date": "2026-07-02 16:27:00",
          "tags": [
            "#Lokibot"
          ],
          "tweet": "https://x.com/skocherhan/status/2072718925628907722",
          "type": "md5",
          "user": "skocherhan",
          "value": "687bf1633615388cb4b7bd3f726507e4"
        }
      ],
      "last_seen": "2026-07-02",
      "member_cluster_ids": [
        "tfc-e5b08e24a9bf"
      ],
      "name": "Lokibot C2 on alphastand multi-TLD cluster",
      "reporters": [
        "skocherhan"
      ],
      "tags": [
        "#Lokibot"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 5,
        "md5": 1,
        "url": 5
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "ydns.eu"
        ],
        "tags": [
          "#Xworm"
        ],
        "url_path_patterns": []
      },
      "confidence": "medium",
      "context": "An XWorm RAT campaign using pkgovt.help - a domain mimicking Pakistani government infrastructure - alongside ydns.eu dynamic DNS hostnames (vvcc.ydns.eu, bdvcredimujerr.ydns.eu) as C2 endpoints resolving to IPs in disparate network ranges. The government-impersonating domain is likely used in phishing lures distributing the XWorm payload to add apparent legitimacy. Ten IOCs were reported by two researchers on July 2.",
      "first_seen": "2026-07-02",
      "id": "tfc-cae506d189b2",
      "ioc_count": 10,
      "iocs": [
        {
          "date": "2026-07-02 18:44:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2072753261426172128",
          "type": "url",
          "user": "skocherhan",
          "value": "http://bdvcredimujerr.ydns.eu"
        },
        {
          "date": "2026-07-02 18:44:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/skocherhan/status/2072753261426172128",
          "type": "domain",
          "user": "skocherhan",
          "value": "bdvcredimujerr.ydns.eu"
        },
        {
          "date": "2026-07-02 17:44:00",
          "tags": [
            "#Xworm"
          ],
          "tweet": "https://x.com/smica83/status/2072738160098824231",
          "type": "url",
          "user": "smica83",
          "value": "http://155.103.69.160:2839"
        },
        {
          "date": "2026-07-02 17:44:00",
          "tags": [
            "#Xworm"
          ],
          "tweet": "https://x.com/smica83/status/2072738160098824231",
          "type": "sha256",
          "user": "smica83",
          "value": "c753488426339c67753f544673bb51ced93586620cbeecf8f7a703133fd9c0bd"
        },
        {
          "date": "2026-07-02 17:44:00",
          "tags": [
            "#Xworm"
          ],
          "tweet": "https://x.com/smica83/status/2072738160098824231",
          "type": "ip",
          "user": "smica83",
          "value": "155.103.69.160"
        },
        {
          "date": "2026-07-02 16:33:00",
          "tags": [
            "#Xworm"
          ],
          "tweet": "https://x.com/skocherhan/status/2072720261640487416",
          "type": "domain",
          "user": "skocherhan",
          "value": "vvcc.ydns.eu"
        },
        {
          "date": "2026-07-02 16:33:00",
          "tags": [
            "#Xworm"
          ],
          "tweet": "https://x.com/skocherhan/status/2072720261640487416",
          "type": "url",
          "user": "skocherhan",
          "value": "http://vvcc.ydns.eu"
        },
        {
          "date": "2026-07-02 16:33:00",
          "tags": [
            "#Xworm"
          ],
          "tweet": "https://x.com/skocherhan/status/2072720261640487416",
          "type": "url",
          "user": "skocherhan",
          "value": "http://64.89.162.178:8793"
        },
        {
          "date": "2026-07-02 16:33:00",
          "tags": [
            "#Xworm"
          ],
          "tweet": "https://x.com/skocherhan/status/2072720261640487416",
          "type": "md5",
          "user": "skocherhan",
          "value": "7756a7ef6468a2b1038e0c28826ddb18"
        },
        {
          "date": "2026-07-02 16:33:00",
          "tags": [
            "#Xworm"
          ],
          "tweet": "https://x.com/skocherhan/status/2072720261640487416",
          "type": "ip",
          "user": "skocherhan",
          "value": "64.89.162.178"
        }
      ],
      "last_seen": "2026-07-02",
      "member_cluster_ids": [
        "tfc-cae506d189b2"
      ],
      "name": "XWorm C2 using pkgovt.help Pakistan government lure",
      "reporters": [
        "skocherhan",
        "smica83"
      ],
      "tags": [
        "#Xworm",
        "#phishing"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 2,
        "ip": 2,
        "md5": 1,
        "sha256": 1,
        "url": 4
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "jxuw3.com",
          "sjickdeh.org"
        ],
        "tags": [],
        "url_path_patterns": []
      },
      "confidence": "low",
      "context": "Two domains flagged as APT and malware C2 by the same two researchers on July 1 share reporter overlap and subdomain naming conventions suggesting related infrastructure. sjickdeh.org hosts subdomains with explicit C2 labels (C2df.*, df.*), while jxuw3.com uses installer-prefixed subdomains (installer3w.*, 3w.*) consistent with payload staging. No specific malware family or attribution was identified in the available data. Eight IOCs across two domains were reported by GenThreatLabs and skocherhan.",
      "first_seen": "2026-07-01",
      "id": "tfc-5c32b15ed96c",
      "ioc_count": 8,
      "iocs": [
        {
          "date": "2026-07-01 15:10:00",
          "tags": [
            "#APT",
            "#malware"
          ],
          "tweet": "https://x.com/skocherhan/status/2072337157956440555",
          "type": "domain",
          "user": "skocherhan",
          "value": "installer3w.jxuw3.com"
        },
        {
          "date": "2026-07-01 15:10:00",
          "tags": [
            "#APT",
            "#malware"
          ],
          "tweet": "https://x.com/skocherhan/status/2072337157956440555",
          "type": "url",
          "user": "skocherhan",
          "value": "http://installer3w.jxuw3.com"
        },
        {
          "date": "2026-07-01 15:10:00",
          "tags": [
            "#APT",
            "#malware"
          ],
          "tweet": "https://x.com/skocherhan/status/2072337157956440555",
          "type": "url",
          "user": "skocherhan",
          "value": "http://C2df.sjickdeh.org"
        },
        {
          "date": "2026-07-01 15:10:00",
          "tags": [
            "#APT",
            "#malware"
          ],
          "tweet": "https://x.com/skocherhan/status/2072337157956440555",
          "type": "domain",
          "user": "skocherhan",
          "value": "C2df.sjickdeh.org"
        },
        {
          "date": "2026-07-01 15:05:00",
          "tags": [
            "#APT",
            "#malware"
          ],
          "tweet": "https://x.com/GenThreatLabs/status/2072335910042050819",
          "type": "url",
          "user": "GenThreatLabs",
          "value": "http://df.sjickdeh.org"
        },
        {
          "date": "2026-07-01 15:05:00",
          "tags": [
            "#APT",
            "#malware"
          ],
          "tweet": "https://x.com/GenThreatLabs/status/2072335910042050819",
          "type": "url",
          "user": "GenThreatLabs",
          "value": "http://3w.jxuw3.com"
        },
        {
          "date": "2026-07-01 15:05:00",
          "tags": [
            "#APT",
            "#malware"
          ],
          "tweet": "https://x.com/GenThreatLabs/status/2072335910042050819",
          "type": "domain",
          "user": "GenThreatLabs",
          "value": "df.sjickdeh.org"
        },
        {
          "date": "2026-07-01 15:05:00",
          "tags": [
            "#APT",
            "#malware"
          ],
          "tweet": "https://x.com/GenThreatLabs/status/2072335910042050819",
          "type": "domain",
          "user": "GenThreatLabs",
          "value": "3w.jxuw3.com"
        }
      ],
      "last_seen": "2026-07-01",
      "member_cluster_ids": [
        "tfc-5c32b15ed96c",
        "tfc-6e209caa8fd0"
      ],
      "name": "APT C2 infrastructure on sjickdeh.org and jxuw3.com",
      "reporters": [
        "GenThreatLabs",
        "skocherhan"
      ],
      "tags": [
        "#APT",
        "#malware"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 4,
        "url": 4
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "5gsewa.cyou"
        ],
        "tags": [],
        "url_path_patterns": [
          "/login.php"
        ]
      },
      "confidence": "low",
      "context": "Credential-harvesting phishing pages are hosted under subdomains of 5gsewa.cyou, specifically birth.5gsewa.cyou, with active /login.php and /csr endpoints. The targeted brand or service is not established from the available data. Seven IOCs were reported by three researchers between July 4 and 5.",
      "first_seen": "2026-07-04",
      "id": "tfc-2840af10b019",
      "ioc_count": 7,
      "iocs": [
        {
          "date": "2026-07-05 09:23:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/CyberXlx9q/status/2073699378049794089",
          "type": "url",
          "user": "CyberXlx9q",
          "value": "http://birth.5gsewa.cyou"
        },
        {
          "date": "2026-07-05 06:06:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/PhishStats/status/2073649702403276958",
          "type": "url",
          "user": "PhishStats",
          "value": "http://birth.5gsewa.cyou/login.php"
        },
        {
          "date": "2026-07-05 06:06:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/PhishStats/status/2073649702403276958",
          "type": "domain",
          "user": "PhishStats",
          "value": "birth.5gsewa.cyou"
        },
        {
          "date": "2026-07-04 17:53:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/Malwarehunterr/status/2073465217888223424",
          "type": "url",
          "user": "Malwarehunterr",
          "value": "http://birth.5gsewa.cyou/login.php"
        },
        {
          "date": "2026-07-04 17:53:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/Malwarehunterr/status/2073465217888223424",
          "type": "url",
          "user": "Malwarehunterr",
          "value": "http://birth.5gsewa.cyou/csr"
        },
        {
          "date": "2026-07-04 17:53:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/Malwarehunterr/status/2073465217888223424",
          "type": "url",
          "user": "Malwarehunterr",
          "value": "http://birth.5gsewa.cyou"
        },
        {
          "date": "2026-07-04 17:53:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/Malwarehunterr/status/2073465217888223424",
          "type": "domain",
          "user": "Malwarehunterr",
          "value": "birth.5gsewa.cyou"
        }
      ],
      "last_seen": "2026-07-05",
      "member_cluster_ids": [
        "tfc-2840af10b019"
      ],
      "name": "Phishing login pages on 5gsewa.cyou subdomains",
      "reporters": [
        "CyberXlx9q",
        "Malwarehunterr",
        "PhishStats"
      ],
      "tags": [
        "#phishing"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 2,
        "url": 5
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "proposaldocs-eu.s3.eu-west-3.amazonaws.com",
          "tmpdrop.s3.eu-west-3.amazonaws.com",
          "vibrbucket.s3.eu-west-3.amazonaws.com"
        ],
        "tags": [],
        "url_path_patterns": [
          "/pdf%Nfile/payload.dll",
          "/pdf%Nfile/sN-uploader.exe",
          "/pdf%Nfile/stage.hta"
        ]
      },
      "confidence": "medium",
      "context": "A malware staging operation abuses Amazon S3 buckets in the eu-west-3 (Paris) region to host payloads under a '/pdf file/' path designed to appear as a document download lure. Three buckets were identified - proposaldocs-eu and vibrbucket serving a Windows executable (s3-uploader.exe), and tmpdrop hosting a two-stage payload chain of stage.hta and payload.dll. Seven IOCs across three S3 buckets were all reported by nextronresearch on June 30.",
      "first_seen": "2026-06-30",
      "id": "tfc-edfc16c0c342",
      "ioc_count": 7,
      "iocs": [
        {
          "date": "2026-06-30 07:55:00",
          "tags": [],
          "tweet": "https://x.com/nextronresearch/status/2071865199892611439",
          "type": "domain",
          "user": "nextronresearch",
          "value": "vibrbucket.s3.eu-west-3.amazonaws.com"
        },
        {
          "date": "2026-06-30 07:55:00",
          "tags": [],
          "tweet": "https://x.com/nextronresearch/status/2071865199892611439",
          "type": "domain",
          "user": "nextronresearch",
          "value": "tmpdrop.s3.eu-west-3.amazonaws.com"
        },
        {
          "date": "2026-06-30 07:55:00",
          "tags": [],
          "tweet": "https://x.com/nextronresearch/status/2071865199892611439",
          "type": "domain",
          "user": "nextronresearch",
          "value": "proposaldocs-eu.s3.eu-west-3.amazonaws.com"
        },
        {
          "date": "2026-06-30 07:55:00",
          "tags": [],
          "tweet": "https://x.com/nextronresearch/status/2071865199892611439",
          "type": "url",
          "user": "nextronresearch",
          "value": "http://vibrbucket.s3.eu-west-3.amazonaws.com/pdf%20file/s3-uploader.exe"
        },
        {
          "date": "2026-06-30 07:55:00",
          "tags": [],
          "tweet": "https://x.com/nextronresearch/status/2071865199892611439",
          "type": "url",
          "user": "nextronresearch",
          "value": "http://tmpdrop.s3.eu-west-3.amazonaws.com/pdf%20file/stage.hta"
        },
        {
          "date": "2026-06-30 07:55:00",
          "tags": [],
          "tweet": "https://x.com/nextronresearch/status/2071865199892611439",
          "type": "url",
          "user": "nextronresearch",
          "value": "http://tmpdrop.s3.eu-west-3.amazonaws.com/pdf%20file/payload.dll"
        },
        {
          "date": "2026-06-30 07:55:00",
          "tags": [],
          "tweet": "https://x.com/nextronresearch/status/2071865199892611439",
          "type": "url",
          "user": "nextronresearch",
          "value": "http://proposaldocs-eu.s3.eu-west-3.amazonaws.com/pdf%20file/s3-uploader.exe"
        }
      ],
      "last_seen": "2026-06-30",
      "member_cluster_ids": [
        "tfc-edfc16c0c342",
        "tfc-1ae506c72c87"
      ],
      "name": "Malware staging via AWS S3 eu-west-3 PDF lure buckets",
      "reporters": [
        "nextronresearch"
      ],
      "tags": [],
      "targeted_brand": null,
      "types": {
        "domain": 3,
        "url": 4
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "axincoins.top"
        ],
        "tags": [],
        "url_path_patterns": []
      },
      "confidence": "low",
      "context": "A cryptocurrency-themed domain, axincoins.top, operates with a dedicated download subdomain (download.axincoins.top) and is flagged as both phishing and malware hosting. The specific cryptocurrency brand or service being impersonated is not established from available data. Six IOCs were reported by two researchers between July 2 and 3.",
      "first_seen": "2026-07-02",
      "id": "tfc-1e899ab02843",
      "ioc_count": 6,
      "iocs": [
        {
          "date": "2026-07-03 00:13:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/PhishStats/status/2072836155964330194",
          "type": "url",
          "user": "PhishStats",
          "value": "https://axincoins.top"
        },
        {
          "date": "2026-07-03 00:13:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/PhishStats/status/2072836155964330194",
          "type": "domain",
          "user": "PhishStats",
          "value": "axincoins.top"
        },
        {
          "date": "2026-07-02 12:18:00",
          "tags": [
            "#malware",
            "#phishing"
          ],
          "tweet": "https://x.com/Malwarehunterr/status/2072656168489828629",
          "type": "url",
          "user": "Malwarehunterr",
          "value": "http://download.axincoins.top"
        },
        {
          "date": "2026-07-02 12:18:00",
          "tags": [
            "#malware",
            "#phishing"
          ],
          "tweet": "https://x.com/Malwarehunterr/status/2072656168489828629",
          "type": "url",
          "user": "Malwarehunterr",
          "value": "http://axincoins.top"
        },
        {
          "date": "2026-07-02 12:18:00",
          "tags": [
            "#malware",
            "#phishing"
          ],
          "tweet": "https://x.com/Malwarehunterr/status/2072656168489828629",
          "type": "domain",
          "user": "Malwarehunterr",
          "value": "download.axincoins.top"
        },
        {
          "date": "2026-07-02 12:18:00",
          "tags": [
            "#malware",
            "#phishing"
          ],
          "tweet": "https://x.com/Malwarehunterr/status/2072656168489828629",
          "type": "domain",
          "user": "Malwarehunterr",
          "value": "axincoins.top"
        }
      ],
      "last_seen": "2026-07-03",
      "member_cluster_ids": [
        "tfc-1e899ab02843"
      ],
      "name": "Cryptocurrency phishing and download site axincoins.top",
      "reporters": [
        "Malwarehunterr",
        "PhishStats"
      ],
      "tags": [
        "#malware",
        "#phishing"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 3,
        "url": 3
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "hfzk.net.cn"
        ],
        "tags": [],
        "url_path_patterns": [
          "/frontend/auth",
          "/houjin/index.html"
        ]
      },
      "confidence": "high",
      "context": "An adversary-in-the-middle phishing operation targeting MUFG Bank corporate and retail customers using hfzk.net.cn as a reverse-proxy domain. Subdomains encode MUFG's legitimate domain using double-dash separators (e.g., corporate--bk--mufg--jp.proxy.hfzk.net.cn, bizstation--bk--mufg--jp.proxy.hfzk.net.cn), a technique associated with phishing proxy kits that transparently relay sessions to steal credentials. Six IOCs covering MUFG's BizStation and corporate banking portals were reported by one researcher on July 2.",
      "first_seen": "2026-07-02",
      "id": "tfc-8229e7bd718a",
      "ioc_count": 6,
      "iocs": [
        {
          "date": "2026-07-02 21:06:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/kubotaa3/status/2072788966462685267",
          "type": "domain",
          "user": "kubotaa3",
          "value": "www--bk--mufg--jp.proxy.hfzk.net.cn"
        },
        {
          "date": "2026-07-02 21:06:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/kubotaa3/status/2072788966462685267",
          "type": "url",
          "user": "kubotaa3",
          "value": "https://www--bk--mufg--jp.proxy.hfzk.net.cn/houjin/index.html"
        },
        {
          "date": "2026-07-02 21:06:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/kubotaa3/status/2072788966462685267",
          "type": "url",
          "user": "kubotaa3",
          "value": "https://bizstation--bk--mufg--jp.proxy.hfzk.net.cn"
        },
        {
          "date": "2026-07-02 21:06:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/kubotaa3/status/2072788966462685267",
          "type": "domain",
          "user": "kubotaa3",
          "value": "bizstation--bk--mufg--jp.proxy.hfzk.net.cn"
        },
        {
          "date": "2026-07-02 20:33:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/kubotaa3/status/2072780618673651812",
          "type": "url",
          "user": "kubotaa3",
          "value": "https://corporate--bk--mufg--jp.proxy.hfzk.net.cn/frontend/auth"
        },
        {
          "date": "2026-07-02 20:33:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/kubotaa3/status/2072780618673651812",
          "type": "domain",
          "user": "kubotaa3",
          "value": "corporate--bk--mufg--jp.proxy.hfzk.net.cn"
        }
      ],
      "last_seen": "2026-07-02",
      "member_cluster_ids": [
        "tfc-8229e7bd718a"
      ],
      "name": "MUFG corporate banking phishing via hfzk.net.cn proxy",
      "reporters": [
        "kubotaa3"
      ],
      "tags": [
        "#phishing"
      ],
      "targeted_brand": "MUFG Bank",
      "types": {
        "domain": 3,
        "url": 3
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "acrypters.workers.dev",
          "guhudeolokghguhumandeylikebroemdfhhfhsjj.duckdns.org"
        ],
        "tags": [
          "#Remcos"
        ],
        "url_path_patterns": []
      },
      "confidence": "medium",
      "context": "A Remcos RAT campaign routing C2 traffic through a Cloudflare Workers subdomain (blue-paper-f69f.acrypters.workers.dev) and a DuckDNS hostname with an unusually long random label, alongside a bare IP. This pattern uses legitimate hosting platforms to evade IP-based network detection. Six IOCs were reported by one researcher on July 2.",
      "first_seen": "2026-07-02",
      "id": "tfc-c6451bf78211",
      "ioc_count": 6,
      "iocs": [
        {
          "date": "2026-07-02 09:19:00",
          "tags": [
            "#Remcos"
          ],
          "tweet": "https://x.com/skocherhan/status/2072611085685825855",
          "type": "url",
          "user": "skocherhan",
          "value": "http://guhudeolokghguhumandeylikebroemdfhhfhsjj.duckdns.org"
        },
        {
          "date": "2026-07-02 09:19:00",
          "tags": [
            "#Remcos"
          ],
          "tweet": "https://x.com/skocherhan/status/2072611085685825855",
          "type": "url",
          "user": "skocherhan",
          "value": "http://blue-paper-f69f.acrypters.workers.dev"
        },
        {
          "date": "2026-07-02 09:19:00",
          "tags": [
            "#Remcos"
          ],
          "tweet": "https://x.com/skocherhan/status/2072611085685825855",
          "type": "url",
          "user": "skocherhan",
          "value": "http://103.83.87.107"
        },
        {
          "date": "2026-07-02 09:19:00",
          "tags": [
            "#Remcos"
          ],
          "tweet": "https://x.com/skocherhan/status/2072611085685825855",
          "type": "domain",
          "user": "skocherhan",
          "value": "guhudeolokghguhumandeylikebroemdfhhfhsjj.duckdns.org"
        },
        {
          "date": "2026-07-02 09:19:00",
          "tags": [
            "#Remcos"
          ],
          "tweet": "https://x.com/skocherhan/status/2072611085685825855",
          "type": "domain",
          "user": "skocherhan",
          "value": "blue-paper-f69f.acrypters.workers.dev"
        },
        {
          "date": "2026-07-02 09:19:00",
          "tags": [
            "#Remcos"
          ],
          "tweet": "https://x.com/skocherhan/status/2072611085685825855",
          "type": "ip",
          "user": "skocherhan",
          "value": "103.83.87.107"
        }
      ],
      "last_seen": "2026-07-02",
      "member_cluster_ids": [
        "tfc-c6451bf78211"
      ],
      "name": "Remcos RAT C2 via Cloudflare Workers and DuckDNS",
      "reporters": [
        "skocherhan"
      ],
      "tags": [
        "#Remcos"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 2,
        "ip": 1,
        "url": 3
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "screenconnect.com"
        ],
        "tags": [],
        "url_path_patterns": [
          "/Bin/ScreenConnect.ClientSetup.exe",
          "/Bin/ScreenConnect.ClientSetup.msi"
        ]
      },
      "confidence": "medium",
      "context": "Threat actors are abusing the ScreenConnect remote management platform by generating malicious client installer links under custom subdomain instances (brookingsagent, garotalinda, zoomco, equipodecervezaelmoe) hosted on screenconnect.com infrastructure. Both .exe and .msi installer variants are distributed, consistent with phishing-delivered persistent remote access campaigns. Nine IOCs were reported by two researchers between June 29 and July 5.",
      "first_seen": "2026-07-03",
      "id": "tfc-c79c37830260",
      "ioc_count": 6,
      "iocs": [
        {
          "date": "2026-07-05 03:48:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/patialavii/status/2073614965374853381",
          "type": "url",
          "user": "patialavii",
          "value": "https://equipodecervezaelmoe.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi"
        },
        {
          "date": "2026-07-05 03:48:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/patialavii/status/2073614965374853381",
          "type": "domain",
          "user": "patialavii",
          "value": "equipodecervezaelmoe.screenconnect.com"
        },
        {
          "date": "2026-07-03 12:57:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/patialavii/status/2073028303418462540",
          "type": "domain",
          "user": "patialavii",
          "value": "zoomco.screenconnect.com"
        },
        {
          "date": "2026-07-03 12:57:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/patialavii/status/2073028303418462540",
          "type": "url",
          "user": "patialavii",
          "value": "https://zoomco.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe"
        },
        {
          "date": "2026-07-03 12:49:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/patialavii/status/2073026348147511358",
          "type": "url",
          "user": "patialavii",
          "value": "https://garotalinda.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi"
        },
        {
          "date": "2026-07-03 12:49:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/patialavii/status/2073026348147511358",
          "type": "domain",
          "user": "patialavii",
          "value": "garotalinda.screenconnect.com"
        }
      ],
      "last_seen": "2026-07-05",
      "member_cluster_ids": [
        "tfc-c79c37830260"
      ],
      "name": "ScreenConnect RMM abuse via malicious custom subdomains",
      "reporters": [
        "patialavii"
      ],
      "tags": [
        "#phishing"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 3,
        "url": 3
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "time-dns.tech"
        ],
        "tags": [],
        "url_path_patterns": [
          "/gNMqAA/WiNpNe"
        ]
      },
      "confidence": "low",
      "context": "A malware downloader at time-dns.tech serves ZIP archives on port 8080 via randomized URL paths (e.g., /g0MqAA/Wi7p1e/15BsQa.zip), with filenames varying per request. The randomized path and filename structure is consistent with a stager delivering second-stage payloads. Five IOCs were reported by two researchers on July 3.",
      "first_seen": "2026-07-03",
      "id": "tfc-6d45350711af",
      "ioc_count": 5,
      "iocs": [
        {
          "date": "2026-07-03 13:35:00",
          "tags": [],
          "tweet": "https://x.com/skocherhan/status/2073037805916180702",
          "type": "domain",
          "user": "skocherhan",
          "value": "time-dns.tech"
        },
        {
          "date": "2026-07-03 13:35:00",
          "tags": [],
          "tweet": "https://x.com/skocherhan/status/2073037805916180702",
          "type": "url",
          "user": "skocherhan",
          "value": "http://time-dns.tech"
        },
        {
          "date": "2026-07-03 13:29:00",
          "tags": [],
          "tweet": "https://x.com/smica83/status/2073036337997852950",
          "type": "domain",
          "user": "smica83",
          "value": "time-dns.tech:8080"
        },
        {
          "date": "2026-07-03 13:29:00",
          "tags": [],
          "tweet": "https://x.com/smica83/status/2073036337997852950",
          "type": "url",
          "user": "smica83",
          "value": "http://time-dns.tech:8080/g0MqAA/Wi7p1e/15BsQa.zip"
        },
        {
          "date": "2026-07-03 13:29:00",
          "tags": [],
          "tweet": "https://x.com/smica83/status/2073036337997852950",
          "type": "url",
          "user": "smica83",
          "value": "http://time-dns.tech:8080/g0MqAA/Wi7p1e/0IJx0f.zip"
        }
      ],
      "last_seen": "2026-07-03",
      "member_cluster_ids": [
        "tfc-6d45350711af"
      ],
      "name": "Malware ZIP delivery via time-dns.tech on port 8080",
      "reporters": [
        "skocherhan",
        "smica83"
      ],
      "tags": [],
      "targeted_brand": null,
      "types": {
        "domain": 2,
        "url": 3
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "modbdwindtgt.website"
        ],
        "tags": [],
        "url_path_patterns": []
      },
      "confidence": "low",
      "context": "A domain flagged as APT, RAT, and malware infrastructure - modbdwindtgt.website - was observed accepting connections on both port 80 and port 8080. The purpose-registered domain name and use of a non-standard port are consistent with remote-access trojan C2 activity. Four IOCs were reported by one researcher on June 30.",
      "first_seen": "2026-06-30",
      "id": "tfc-2eaba10d578e",
      "ioc_count": 4,
      "iocs": [
        {
          "date": "2026-06-30 13:25:00",
          "tags": [
            "#APT",
            "#RAT",
            "#malware"
          ],
          "tweet": "https://x.com/Cyberteam008/status/2071948156691243131",
          "type": "domain",
          "user": "Cyberteam008",
          "value": "modbdwindtgt.website:8080"
        },
        {
          "date": "2026-06-30 13:25:00",
          "tags": [
            "#APT",
            "#RAT",
            "#malware"
          ],
          "tweet": "https://x.com/Cyberteam008/status/2071948156691243131",
          "type": "domain",
          "user": "Cyberteam008",
          "value": "modbdwindtgt.website"
        },
        {
          "date": "2026-06-30 13:25:00",
          "tags": [
            "#APT",
            "#RAT",
            "#malware"
          ],
          "tweet": "https://x.com/Cyberteam008/status/2071948156691243131",
          "type": "url",
          "user": "Cyberteam008",
          "value": "http://modbdwindtgt.website:8080"
        },
        {
          "date": "2026-06-30 13:25:00",
          "tags": [
            "#APT",
            "#RAT",
            "#malware"
          ],
          "tweet": "https://x.com/Cyberteam008/status/2071948156691243131",
          "type": "url",
          "user": "Cyberteam008",
          "value": "http://modbdwindtgt.website"
        }
      ],
      "last_seen": "2026-06-30",
      "member_cluster_ids": [
        "tfc-2eaba10d578e"
      ],
      "name": "RAT C2 on modbdwindtgt.website",
      "reporters": [
        "Cyberteam008"
      ],
      "tags": [
        "#APT",
        "#RAT",
        "#malware"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 2,
        "url": 2
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "supatradepro.net"
        ],
        "tags": [],
        "url_path_patterns": []
      },
      "confidence": "low",
      "context": "A fraudulent investment or trading platform at supatradepro.net was flagged as a scam by two reporters between July 3 and 5. The site name and pattern are consistent with pig-butchering or advance-fee investment fraud schemes. Four IOCs were reported.",
      "first_seen": "2026-07-03",
      "id": "tfc-2ef39bace40d",
      "ioc_count": 4,
      "iocs": [
        {
          "date": "2026-07-05 13:46:00",
          "tags": [
            "#scam"
          ],
          "tweet": "https://x.com/KelvinBradav/status/2073765421149221117",
          "type": "domain",
          "user": "KelvinBradav",
          "value": "supatradepro.net"
        },
        {
          "date": "2026-07-05 13:46:00",
          "tags": [
            "#scam"
          ],
          "tweet": "https://x.com/KelvinBradav/status/2073765421149221117",
          "type": "url",
          "user": "KelvinBradav",
          "value": "http://supatradepro.net"
        },
        {
          "date": "2026-07-03 13:46:00",
          "tags": [
            "#scam"
          ],
          "tweet": "https://x.com/JB41842826/status/2073040730247815578",
          "type": "domain",
          "user": "JB41842826",
          "value": "supatradepro.net"
        },
        {
          "date": "2026-07-03 13:46:00",
          "tags": [
            "#scam"
          ],
          "tweet": "https://x.com/JB41842826/status/2073040730247815578",
          "type": "url",
          "user": "JB41842826",
          "value": "http://supatradepro.net"
        }
      ],
      "last_seen": "2026-07-05",
      "member_cluster_ids": [
        "tfc-2ef39bace40d"
      ],
      "name": "Investment trading scam via supatradepro.net",
      "reporters": [
        "JB41842826",
        "KelvinBradav"
      ],
      "tags": [
        "#scam"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 2,
        "url": 2
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "antigravity.study"
        ],
        "tags": [
          "#ClickFix"
        ],
        "url_path_patterns": []
      },
      "confidence": "medium",
      "context": "A ClickFix campaign using antigravity.study to display fake error or CAPTCHA prompts that instruct victims to paste and execute malicious clipboard content, resulting in malware installation. A matched MD5 and SHA256 hash were reported alongside the domain and URL. Four IOCs were reported by three researchers between July 1 and 3.",
      "first_seen": "2026-07-01",
      "id": "tfc-992d72dc909b",
      "ioc_count": 4,
      "iocs": [
        {
          "date": "2026-07-03 08:44:00",
          "tags": [
            "#ClickFix"
          ],
          "tweet": "https://x.com/ThreatviewioLab/status/2072964708999823842",
          "type": "url",
          "user": "ThreatviewioLab",
          "value": "http://antigravity.study"
        },
        {
          "date": "2026-07-03 08:44:00",
          "tags": [
            "#ClickFix"
          ],
          "tweet": "https://x.com/ThreatviewioLab/status/2072964708999823842",
          "type": "domain",
          "user": "ThreatviewioLab",
          "value": "antigravity.study"
        },
        {
          "date": "2026-07-02 16:21:00",
          "tags": [
            "#ClickFix"
          ],
          "tweet": "https://x.com/skocherhan/status/2072717272494342406",
          "type": "sha256",
          "user": "skocherhan",
          "value": "7f85c8c4dbba2c4907057ef77973762ffb60bc4fea55a25c7b320f3f0e8059e7"
        },
        {
          "date": "2026-07-01 12:39:00",
          "tags": [
            "#ClickFix"
          ],
          "tweet": "https://x.com/suyog41/status/2072298995100377425",
          "type": "md5",
          "user": "suyog41",
          "value": "0129e1e1666d5bcce8c3f12c866fdb23"
        }
      ],
      "last_seen": "2026-07-03",
      "member_cluster_ids": [
        "tfc-992d72dc909b"
      ],
      "name": "ClickFix social engineering campaign via antigravity.study",
      "reporters": [
        "ThreatviewioLab",
        "skocherhan",
        "suyog41"
      ],
      "tags": [
        "#ClickFix"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 1,
        "md5": 1,
        "sha256": 1,
        "url": 1
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "quantumstraderslink.com"
        ],
        "tags": [],
        "url_path_patterns": [
          "/courtrecords/justicegov"
        ]
      },
      "confidence": "low",
      "context": "A phishing site at quantumstraderslink.com impersonates U.S. Department of Justice court records, with paths /courtrecords/justicegov/complete.php and /courtrecords/justicegov/download.php likely delivering a malicious file under a legal-threat pretext. Court records lures are commonly used in social engineering campaigns to pressure victims into opening payloads. Three IOCs were reported by one researcher on June 30.",
      "first_seen": "2026-06-30",
      "id": "tfc-02d2959fa652",
      "ioc_count": 3,
      "iocs": [
        {
          "date": "2026-06-30 17:41:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/patialavii/status/2072012553061118449",
          "type": "domain",
          "user": "patialavii",
          "value": "quantumstraderslink.com"
        },
        {
          "date": "2026-06-30 17:41:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/patialavii/status/2072012553061118449",
          "type": "url",
          "user": "patialavii",
          "value": "https://quantumstraderslink.com/courtrecords/justicegov/download.php"
        },
        {
          "date": "2026-06-30 17:41:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/patialavii/status/2072012553061118449",
          "type": "url",
          "user": "patialavii",
          "value": "https://quantumstraderslink.com/courtrecords/justicegov/complete.php"
        }
      ],
      "last_seen": "2026-06-30",
      "member_cluster_ids": [
        "tfc-02d2959fa652"
      ],
      "name": "DOJ court records phishing via quantumstraderslink.com",
      "reporters": [
        "patialavii"
      ],
      "tags": [
        "#phishing"
      ],
      "targeted_brand": "U.S. Department of Justice",
      "types": {
        "domain": 1,
        "url": 2
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "enogcaen-br.com"
        ],
        "tags": [
          "#AgentTesla"
        ],
        "url_path_patterns": []
      },
      "confidence": "low",
      "context": "An AgentTesla infostealer sample exfiltrates stolen credentials via FTP to ftp.enogcaen-br.com. Three IOCs including a SHA256 hash were reported by one researcher on June 30. AgentTesla is a widely-distributed commodity credential stealer commonly delivered through phishing emails.",
      "first_seen": "2026-06-30",
      "id": "tfc-2e22641a4810",
      "ioc_count": 3,
      "iocs": [
        {
          "date": "2026-06-30 05:45:00",
          "tags": [
            "#AgentTesla"
          ],
          "tweet": "https://x.com/bomccss/status/2071832499286872112",
          "type": "url",
          "user": "bomccss",
          "value": "http://ftp.enogcaen-br.com"
        },
        {
          "date": "2026-06-30 05:45:00",
          "tags": [
            "#AgentTesla"
          ],
          "tweet": "https://x.com/bomccss/status/2071832499286872112",
          "type": "domain",
          "user": "bomccss",
          "value": "ftp.enogcaen-br.com"
        },
        {
          "date": "2026-06-30 05:45:00",
          "tags": [
            "#AgentTesla"
          ],
          "tweet": "https://x.com/bomccss/status/2071832499286872112",
          "type": "sha256",
          "user": "bomccss",
          "value": "4c497ee749359905141c034740c2b04b427e868c0ff1b949bae90753396e2ccf"
        }
      ],
      "last_seen": "2026-06-30",
      "member_cluster_ids": [
        "tfc-2e22641a4810"
      ],
      "name": "AgentTesla infostealer with FTP exfil via enogcaen-br.com",
      "reporters": [
        "bomccss"
      ],
      "tags": [
        "#AgentTesla"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 1,
        "sha256": 1,
        "url": 1
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "psycch2.club"
        ],
        "tags": [],
        "url_path_patterns": [
          "/A_rmm_vN.N.N.N_oidfNeN-bN-NdN-Ne-NfNaNeNdN_bidhuNRZxNUNUOPHONxNuhYA.exe"
        ]
      },
      "confidence": "low",
      "context": "A phishing or social engineering campaign hosts an RMM software installer at bl.psycch2.club with a filename encoding a version number (v2.5.0.67) and a UUID, consistent with a customized or tracked deployment package. An additional /ftx endpoint at the same subdomain suggests further payload staging. Three IOCs were reported by one researcher on July 3.",
      "first_seen": "2026-07-03",
      "id": "tfc-49c88b7e7016",
      "ioc_count": 3,
      "iocs": [
        {
          "date": "2026-07-03 12:41:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/patialavii/status/2073024331534508358",
          "type": "url",
          "user": "patialavii",
          "value": "https://bl.psycch2.club/ftx"
        },
        {
          "date": "2026-07-03 12:41:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/patialavii/status/2073024331534508358",
          "type": "url",
          "user": "patialavii",
          "value": "https://bl.psycch2.club/A_rmm_v2.5.0.67_oidf4020e13-b122-49d8-929e-3f44a229e8d3_bidhu7RZx2U4UOPHO2x56uhYA.exe"
        },
        {
          "date": "2026-07-03 12:41:00",
          "tags": [
            "#phishing"
          ],
          "tweet": "https://x.com/patialavii/status/2073024331534508358",
          "type": "domain",
          "user": "patialavii",
          "value": "bl.psycch2.club"
        }
      ],
      "last_seen": "2026-07-03",
      "member_cluster_ids": [
        "tfc-49c88b7e7016"
      ],
      "name": "RMM installer phishing via psycch2.club",
      "reporters": [
        "patialavii"
      ],
      "tags": [
        "#phishing"
      ],
      "targeted_brand": null,
      "types": {
        "domain": 1,
        "url": 2
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "github.com"
        ],
        "tags": [],
        "url_path_patterns": [
          "/dcmN-N",
          "/tkdzNQKkxNJNzlWrCNnt/data",
          "/up-N"
        ]
      },
      "confidence": "low",
      "context": "A stealer campaign abuses GitHub for configuration or payload hosting, with references to multiple GitHub user profile pages (dcm1-6626, up-6626) and a repository serving an encrypted data file (data.enc) from the main branch. The technique of using GitHub-hosted encrypted files as dead-drop resolvers exploits the platform's trusted reputation to evade network-level detection. Three IOCs were reported by two researchers on July 3.",
      "first_seen": "2026-07-03",
      "id": "tfc-64896c80e6cd",
      "ioc_count": 3,
      "iocs": [
        {
          "date": "2026-07-03 09:48:00",
          "tags": [],
          "tweet": "https://x.com/smica83/status/2072980727050707328",
          "type": "url",
          "user": "smica83",
          "value": "https://github.com/tkdz4QKkx26J4zlWrC5nt/data/raw/refs/heads/main/data.enc"
        },
        {
          "date": "2026-07-03 06:17:00",
          "tags": [
            "#stealer"
          ],
          "tweet": "https://x.com/suyog41/status/2072927604647346518",
          "type": "url",
          "user": "suyog41",
          "value": "http://github.com/up-6626"
        },
        {
          "date": "2026-07-03 06:17:00",
          "tags": [
            "#stealer"
          ],
          "tweet": "https://x.com/suyog41/status/2072927604647346518",
          "type": "url",
          "user": "suyog41",
          "value": "http://github.com/dcm1-6626"
        }
      ],
      "last_seen": "2026-07-03",
      "member_cluster_ids": [
        "tfc-64896c80e6cd"
      ],
      "name": "Stealer using GitHub repos as dead-drop C2 hosts",
      "reporters": [
        "smica83",
        "suyog41"
      ],
      "tags": [
        "#stealer"
      ],
      "targeted_brand": null,
      "types": {
        "url": 3
      }
    },
    {
      "anchors": {
        "registered_domains": [
          "taxassessment.cyou"
        ],
        "tags": [],
        "url_path_patterns": [
          "/Tax_Assessment_N.zip",
          "/Tax_Assessment_sg.zip"
        ]
      },
      "confidence": "low",
      "context": "A malware distribution site at taxassessment.cyou delivers ZIP archives using tax-themed filenames, including Tax_Assessment_0609.zip and Tax_Assessment_sg.zip. The 'sg' filename suffix suggests the campaign may be targeting victims in Singapore. Three IOCs were reported by one researcher on July 4.",
      "first_seen": "2026-07-04",
      "id": "tfc-d5902fbcabd7",
      "ioc_count": 3,
      "iocs": [
        {
          "date": "2026-07-04 05:34:00",
          "tags": [],
          "tweet": "https://x.com/suyog41/status/2065407928249495664",
          "type": "domain",
          "user": "suyog41",
          "value": "taxassessment.cyou"
        },
        {
          "date": "2026-07-04 05:34:00",
          "tags": [],
          "tweet": "https://x.com/suyog41/status/2065407928249495664",
          "type": "url",
          "user": "suyog41",
          "value": "https://taxassessment.cyou/Tax_Assessment_sg.zip"
        },
        {
          "date": "2026-07-04 05:34:00",
          "tags": [],
          "tweet": "https://x.com/suyog41/status/2065407928249495664",
          "type": "url",
          "user": "suyog41",
          "value": "https://taxassessment.cyou/Tax_Assessment_0609.zip"
        }
      ],
      "last_seen": "2026-07-04",
      "member_cluster_ids": [
        "tfc-d5902fbcabd7"
      ],
      "name": "Tax assessment lure delivering ZIP payloads (Singapore)",
      "reporters": [
        "suyog41"
      ],
      "tags": [],
      "targeted_brand": null,
      "types": {
        "domain": 1,
        "url": 2
      }
    }
  ],
  "generated_at": "2026-07-06T06:28:54Z",
  "stale": false,
  "stale_since": null,
  "version": 1,
  "window": "week"
}