Anurag

🚨 RAT/Infostealer C2 Panel

Found docuxsign[.]com hosting a RemoteDesk control panel, with features for remote access, keylogging, password/cookie theft, crypto wallet extraction, seed scanning, clipboard hijacking, and wallet targeted overlays.

The panel also supports Windows/macOS agent generation, remote command execution, file transfers, and Telegram alerts.

IOCs:

docuxsign[.]com
/app.js

API endpoints:

/api/generate
/api/agents
/api/exec
/api/sweep
/api/password_scan
/api/smart_pw
/api/app_lock
/api/export
/api/telegram

Installer paths:

/setup/{code}/win
/setup/{code}/mac

Note: Capabilities identified through frontend source analysis. Agent payload and backend functionality not yet verified.

#ThreatIntel #RAT #Infostealer #Malware @500mk500 @malwrhunterteam @skocherhan @TheKn0ck0ut @KirkDerpca @0x534c @James_inthe_box @AaronCTI @scanmalware @userlolxxl

🚨More Indian Government Fake #eChallan website

echalla[.]xyz
echalla[.]cfd
echalla[.]cam
echalla[.]shop
echalla[.]com
echalla[.]bar

#Phishing #ThreatIntel
@IndianCERT
@Cyberdost @MORTHIndia @gnamedotcom

#Romulus

microsoft-winupdate[.]com/login

🚨 Suspicious Microsoft Teams impersonation website

msteams-ai[.]com

The site mimics Microsoft Teams and offers a "Download Teams" button that triggers a JavaScript-controlled download of setup.exe.

The downloaded EXE is currently 0 bytes. No malicious payload confirmed yet.

IOCs:

Domain: msteams-ai[.]com
File: setup.exe (0 bytes)
JS: /wp-content/themes/wp-teams-ui-v1/assets/js/jquery.min.js
JS: /wp-content/themes/wp-teams-ui-v1/assets/js/download.js
JS: /wp-content/themes/wp-teams-ui-v1/assets/download/filename.js

Observed behavior:

__dl_proxy() fetches and executes download.js using eval()
download.js redirects to window.downloadLink
filename.js sets window.filename = 'setup.exe'

#MicrosoftTeams #Malware #Phishing @MsftSecIntel @500mk500 @skocherhan @TheKn0ck0ut @KirkDerpca @AaronCTI

🚨 Google-Themed Phishing

Suspicious domain my-settings-google[.]com is hosting a fake Google sign-in page.

JavaScript analysis reveals email harvesting functionality that attempts to send user input to a Supabase database (login_typed), with session-based tracking.

The page also contains references to "Salmon Salad", suggesting a customizable login template.

IOCs:

my-settings-google[.]com
www.my-settings-google[.]com

Supabase backend:

soswwsvunulnhlcitpwl.supabase[.]co
/rest/v1/login_typed

JavaScript:

/_next/static/chunks/0s2tdr4vb5378.js
/_next/static/chunks/0x56skhob._h5.js

Vercel asset host:

mu4lkdtjszjvio9g.public.blob.vercel-storage[.]com

#Phishing #Google @500mk500 @skocherhan