Detected #SmartApeSG infection chain

Compromised site
-->
www[.]ski-snowboardvancouver[.]ca/d.js (injected)
-->
blitomra[.]top/scope/realm-html.js
-->
blitomra[.]top/scope/callback-fetch.php
-->
blitomra[.]top/scope/admin-controller.js (clickfix)
-->
qamderil[.]com/rspack (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
thesnackbee[.]com/d.js (injected)
-->
tirqavem[.]top/session/version-header.js
-->
tirqavem[.]top/session/realm-response.php
-->
tirqavem[.]top/session/login-stylesheet.js (clickfix)
-->
qamderil[.]com/rspack (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
tirqavem[.]top/session/realm-response.php
-->
tirqavem[.]top/session/login-stylesheet.js (clickfix)
-->
qamderil[.]com/rspack (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
mezcalpro[.]com/scq (injected)
-->
tirqavem[.]top/session/realm-response.php
-->
tirqavem[.]top/session/login-stylesheet.js (clickfix)
-->
qamderil[.]com/rspack (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
cpajoliette[.]com/q (injected)
-->
wexlunto[.]top/session/realm-response.php
-->
wexlunto[.]top/session/login-stylesheet.js (clickfix)

Detected #SmartApeSG infection chain

Compromised site
-->
cpajoliette[.]com/q (injected)
-->
wexlunto[.]top/session/realm-response.php
-->
wexlunto[.]top/session/login-stylesheet.js (clickfix)
-->
salkunet[.]com/v1/user/py (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
cpajoliette[.]com/q (injected)
-->
wexlunto[.]top/session/realm-response.php
-->
wexlunto[.]top/session/login-stylesheet.js (clickfix)
-->
pelgiron[.]com/v1/user/py (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
tirqavem[.]top/session/realm-response.php
-->
tirqavem[.]top/session/login-stylesheet.js (clickfix)
-->
pelgiron[.]com/v1/user/py (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
cpajoliette[.]com/meta.google.com (injected)
-->
wexlunto[.]top/session/version-header.js
-->
wexlunto[.]top/session/realm-response.php
-->
wexlunto[.]top/session/login-stylesheet.js (clickfix)
-->
pelgiron[.]com/v1/user/py (HTA)

Detected #SmartApeSG infection chain

Compromised site
-->
cpajoliette[.]com/q (injected)
-->
bemqorli[.]top/logout/route-sessionstore.php
-->
bemqorli[.]top/logout/signup-sandbox.js (clickfix)
-->
nivraxod[.]com/opo/call (HTA)