Detected #SmartApeSG infection chain

Compromised site
-->
divinenarratives[.]org/d.js (injected)
-->
linenvoyage[.]top/signin/profile-parser.js
-->
linenvoyage[.]top/signin/auth-json
-->
linenvoyage[.]top/signin/route-script.js (clickfix)

Detected #SmartApeSG infection chain

Compromised site
-->
thesnackbee[.]com/d.js (injected)
-->
linenvoyage[.]top/signin/profile-parser.js
-->
linenvoyage[.]top/signin/auth-json
-->
linenvoyage[.]top/signin/route-script.js (clickfix)

Detected #SmartApeSG infection chain

Compromised site
-->
bronzepavilion[.]top/signin/auth-json
-->
bronzepavilion[.]top/signin/route-script.js (clickfix)

Detected #KongTuke infection chain

Compromised site
-->
oliveiaa[.]icu/file.js (ClickFucker)
-->
oliveiaa[.]icu/api/v1/session (token)
-->
oliveiaa[.]icu/api/v1/verify (gateway)
-->
oliveiaa[.]icu/api/v1/status (clipboard)
-->
secure-code[.]lol/o (powershell)

45d8b6b295a5caabf8df33be9be19b29dd6e284abb43ccc3d8104e7fbc18d693 o

Detected #KongTuke infection chain

Compromised site
-->
oliveiaa[.]icu/file.js (ClickFucker)
-->
oliveiaa[.]icu/api/v1/session (token)
-->
oliveiaa[.]icu/api/v1/verify (gateway)
-->
oliveiaa[.]icu/api/v1/status (clipboard)

Detected #SmartApeSG infection chain

Compromised site
-->
mezcalpro[.]com/scq (injected)
-->
linenvoyage[.]top/signin/profile-parser.js
-->
linenvoyage[.]top/signin/auth-json
-->
linenvoyage[.]top/signin/route-script.js (clickfix)

Detected #KongTuke infection chain

Compromised site
-->
jiminej[.]lol/file.js (ClickFucker)
-->
jiminej[.]lol/api/v1/session (token)
-->
jiminej[.]lol/api/v1/verify (gateway)
-->
jiminej[.]lol/api/v1/status (clipboard)
-->
verif-code[.]lol/o (powershell)

eaf4ebac1a894c72e388994d0f8cda6849daa1750f66ae9f1e432018d7164348 o

Detected #SmartApeSG infection chain

Compromised site
-->
thesnackbee[.]com/d.js (injected)
-->
saffronarchivehub[.]top/role/policy-sessionstore.js
-->
saffronarchivehub[.]top/role/health-json
-->
saffronarchivehub[.]top/role/redirect-html.js (clickfix)

Detected #SmartApeSG infection chain

Compromised site
-->
mezcalpro[.]com/scq (injected)
-->
saffronarchivehub[.]top/role/policy-sessionstore.js
-->
saffronarchivehub[.]top/role/health-json
-->
saffronarchivehub[.]top/role/redirect-html.js (clickfix)

New #SocGholish C2:

hXXps://dl.erickillorinphotostore[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw==
dl.erickillorinphotostore[.]com
45[.]41.187.5
AS22653 Cyber Wurx LLC