Detected #SmartApeSG infection chain

Compromised site
-->
qerunvax[.]top/endpoint/redirect-cookie.php
-->
qerunvax[.]top/endpoint/admin-bundle.js (clickfix)
-->
kaventur[.]com/angular (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
cpajoliette[.]com/q (injected)
-->
zorpelix[.]top/endpoint/redirect-cookie.php
-->
zorpelix[.]top/endpoint/admin-bundle.js (clickfix)
-->
kaventur[.]com/angular (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
cpajoliette[.]com/d.js (injected)
-->
zorpelix[.]top/endpoint/private-sessionstore.js
-->
zorpelix[.]top/endpoint/redirect-cookie.php
-->
zorpelix[.]top/endpoint/admin-bundle.js (clickfix)

Detected #SmartApeSG infection chain

Compromised site
-->
cpajoliette[.]com/q (injected)
-->
blitomra[.]top/scope/callback-fetch.php
-->
blitomra[.]top/scope/admin-controller.js (clickfix)

Detected #SmartApeSG infection chain

Compromised site
-->
cpajoliette[.]com/q (injected)
-->
blitomra[.]top/scope/callback-fetch.php
-->
blitomra[.]top/scope/admin-controller.js (clickfix)
-->
qamderil[.]com/rspack (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
www[.]ski-snowboardvancouver[.]ca/d.js (injected)
-->
blitomra[.]top/scope/realm-html.js
-->
blitomra[.]top/scope/callback-fetch.php
-->
blitomra[.]top/scope/admin-controller.js (clickfix)
-->
qamderil[.]com/rspack (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
thesnackbee[.]com/d.js (injected)
-->
tirqavem[.]top/session/version-header.js
-->
tirqavem[.]top/session/realm-response.php
-->
tirqavem[.]top/session/login-stylesheet.js (clickfix)
-->
qamderil[.]com/rspack (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
tirqavem[.]top/session/realm-response.php
-->
tirqavem[.]top/session/login-stylesheet.js (clickfix)
-->
qamderil[.]com/rspack (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
mezcalpro[.]com/scq (injected)
-->
tirqavem[.]top/session/realm-response.php
-->
tirqavem[.]top/session/login-stylesheet.js (clickfix)
-->
qamderil[.]com/rspack (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
cpajoliette[.]com/q (injected)
-->
wexlunto[.]top/session/realm-response.php
-->
wexlunto[.]top/session/login-stylesheet.js (clickfix)