TF-1933892 high

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-25 16:07:36 UTC. Reporter: varysz. Tags: etherhiding, victim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-25 16:07:36 UTC. Reporter: varysz. Tags: etherhiding, victim.

• One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader ...
  web:blog.sicuranext.com

  A real-world ClickFix intrusion observed from both sandbox and endpoint telemetry, revealing the complete attack path from a compromised WordPress site to a blocked GULoader execution, including a full process creation call stack from the Windows Run dialog to the kernel.

  2026-09-25 21:14 UTC
• IOC Alert: unknown_loader Payload Delivery
  web:darkwebinformer.com

  A new domain -based indicator has been identified associated with payload delivery activity tied to the malware unknown_loader . This domain , advertised under the guise of a mobile advertising and monetization platform, poses a high-confidence threat to users and organizations.

  2026-09-25 21:14 UTC
• DeepLoad Malware Pairs ClickFix Delivery with AI-Generated Evasion
  web:reliaquest.com

  "DeepLoad" malware has arrived in enterprise environments via "ClickFix" delivery, turning one user action into rapid, fileless compromise. It likely uses AI-assisted obfuscation and process injection to evade static scanning, while credential theft starts immediately and captures passwords and sessions even if the primary loader is ...

  2026-09-25 21:14 UTC
• Stealthy Malware Delivery via DNS TXT Records: Detection and Mitigation
  web:undercodetesting.com

  Introduction: Cybercriminals are increasingly abusing DNS TXT records to deliver malware and command-and-control (C2) payloads covertly. A recent investigation by DomainTools revealed how attackers fragment, hex-encode, and distribute malicious code across multiple DNS queries, evading traditional security measures. This article explores detection techniques, mitigation strategies, and hands ...

  2026-09-25 21:14 UTC
• URLhaus | Malware URL exchange
  web:urlhaus.abuse.ch

  URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  2026-09-25 21:14 UTC
• Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your ...
  web:www.esentire.com

  eSentire's TRU uncovered Cruciferra, an EDR-killing malware loader delivered via ClickFix campaigns using a vulnerable signed driver. Read the full threat analysis.

  2026-09-25 21:14 UTC
• Fake Google and Cloudflare verification pages spread multiple malware ...
  web:www.malwarebytes.com

  We uncovered ClickFix attacks using fake Google and Cloudflare pages to deliver everything from infostealers to a newly discovered malware loader .

  2026-09-25 21:14 UTC
• Think before you Click(Fix): Analyzing the ClickFix social engineering ...
  web:www.microsoft.com

  The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.

  2026-09-25 21:14 UTC
• ACR Stealer: Two observed intrusion chains amid increased threat ...
  web:www.microsoft.com

  Mitigation and protection guidance Microsoft recommends the following mitigations to reduce the impact of ClickFix lures, script-based payload delivery, credential theft, and post-compromise activity.

  2026-09-25 21:14 UTC
• When Trusted Websites Turn Malicious: WordPress Compromises ... - Rapid7
  web:www.rapid7.com

  Rapid7 Labs has identified an ongoing, widespread compromise of legitimate WordPress websites, misused by an unidentified threat actor to inject a ClickFix implant (impersonating a Cloudflare human verification challenge [CAPTCHA]). The lure can be used for financial theft or to conduct further, more targeted attacks against organizations.

  2026-09-25 21:14 UTC

Only Available for Registered Users. Sign in to view.