Another day, another 1,738 compromised websites: ClickFix keeps leaning on EtherHiding for C2
ClickFix keeps leaning on EtherHiding for C2 - combined with a prior investigation, this now accounts for over 3,500 compromised sites.
BlueTeamCoolTeam
The ledger keeps talking: mapping five EtherHiding operators, two kit families, and 1,829 confirmed hacked websites
A second EtherHiding contract, a funding link, and a fully revalidated victim count: 1,829 confirmed hacked websites across two distinct kit families.
No File, No Fixed C2: Inside NetCon, a WMI Backdoor That Reads Its Command Server Off the Blockchain
A JScript backdoor persists as a WMI ActiveScriptEventConsumer with no file on disk, resolving its C2 address by reading Ethereum smart-contract storage.
Reading the ledger: how one Polygon smart contract exposed three ClickFix crews and 153 confirmed hacked websites
A ClickFix DLL side-load traced through a Polygon smart contract (EtherHiding) to 18 C2 domains and 153 confirmed hacked sites across three operators.
feintnet: I got tired of FakeNet-NG not running on my ARM box, so I built my own
FakeNet-NG's WinDivert driver wouldn't load on my ARM Windows box, so I built feintnet: a single Go binary that fakes DNS, TLS, and C2 for malware analysis.
Five layers deep for a stealer: reversing the "PuppetKing" ClickFix chain that ended in StealC
Five-stage ClickFix chain reversed statically - game decoy, bitmap stego, custom ConfuserEx, bespoke byte cipher, and StealC v2 with blockchain-rotated C2.
Your RMM Has a Second Owner: Inside a Rogue ScreenConnect Credential Theft Campaign
Three Telegram bots, five named operators, a 3,000-line competitor eviction script -- a newly onboarded host had been compromised for months before the customer onboarded it.
Thirty days of finger commands: three ClickFix families, one TCP/79 delivery vector
25 finger commands over approximately 30 days, three ClickFix families, one TCP/79 delivery vector: IronPython loader, Python RAT lspy, and a pre-positioned DigitalOcean staging cluster.
The Panel Behind the Prompt: OSINT into a Live Lunex Stealer Network
OSINT follow-up to the ClickFix/CAPTCHA campaign: six confirmed Lunex stealer C2 panels across five countries, including a Cloudflare-hidden instance on a Google-impersonating domain. Cookie theft, credential harvesting, real-time JavaScript injection, browser spoofing, and full remote browser control -- documented from the observable panel interface.
Telegram Handles, Binary-Encoded PHP, and a Relay Shell: Inside a WordPress Webshell Compromise
A compromised WordPress site, eleven hundred lines of IIS logs, a two-stage binary-encoded webshell, and six attempts to deploy a gsocket reverse shell.