TF-1868561 high

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown malware. Confidence: 100. First seen: 2026-08-04 23:39:27 UTC. Reporter: anonymous. Tags: ClickFix, macOS, stealer, swiftDialog, wallet.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown malware. Confidence: 100. First seen: 2026-08-04 23:39:27 UTC. Reporter: anonymous. Tags: ClickFix, macOS, stealer, swiftDialog, wallet.

• ️CyberHost Malware and Phishing Blocklist
  web:cyberhost.uk

  Our Malware & Phishing Blocklist is a carefully curated list of known malicious domains , collected from reputable public threat intelligence sources, Infosec communities, and user submissions.

  2026-08-05 06:31 UTC
• Malware Discoverer -- Automatic Malicious Site and Payload Discovery
  web:malwarediscoverer.com

  Discover domain abuse before they impact real users Malicious URL redirection leads to malware , phishing and scam. Waiting for real users to report domain abuse is slow. Our proactive system discovers URL redirections without human interference.

  2026-08-05 06:31 UTC
• Malware Domain List - PrecisionSec
  web:precisionsec.com

  You get the Malware Domain List with every PrecisionSec intelligence subscription, alongside malicious IP, URL and hash feeds. Request evaluation access to see live data, delivery formats and integration options.

  2026-08-05 06:31 UTC
• DriveSurge Uses ClickFix and Fake Update Attacks
  web:socprime.com

  The actor then serves fake browser update pages or ClickFix-style prompts that deliver malware to macOS and Windows users through deceptive downloads or malicious PowerShell commands. Its infrastructure includes thousands of .icu domains registered through NiceNIC and hosted on bulletproof infrastructure.

  2026-08-05 06:31 UTC
• ThreatFox | Share Indicators Of Compromise (IOCs)
  web:threatfox.abuse.ch

  ThreatFox is a platform from abuse.ch and Spamhaus dedicated to sharing indicators of compromise (IOCs) associated with malware , with the infosec community, AV vendors and cyber threat intelligence providers.

  2026-08-05 06:31 UTC
• ThreatFox | Unknown malware
  web:threatfox.abuse.ch

  ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with unknown . You can also get this data through the ThreatFox API. Database Entry

  2026-08-05 06:31 UTC
• Stealthy Malware Delivery via DNS TXT Records: Detection and Mitigation
  web:undercodetesting.com

  Introduction: Cybercriminals are increasingly abusing DNS TXT records to deliver malware and command-and-control (C2) payloads covertly. A recent investigation by DomainTools revealed how attackers fragment, hex-encode, and distribute malicious code across multiple DNS queries, evading traditional security measures. This article explores detection techniques, mitigation strategies, and hands ...

  2026-08-05 06:31 UTC
• URLhaus | Malware URL exchange
  web:urlhaus.abuse.ch

  URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  2026-08-05 06:31 UTC
• URLhaus | Browse - abuse.ch
  web:urlhaus.abuse.ch

  Here you can propose new malware urls or just browse the URLhaus database. If you are looking for a parsable list of the dataset, you might want to check out the URLhaus API.

  2026-08-05 06:31 UTC
• ThreatLog — Malicious Domains Database & Threat Intelligence
  web:www.threatlog.com

  ThreatLog tracks 380,000+ malicious domains linked to malware , phishing, scams and fraud. A continuously growing database of malicious domains .

  2026-08-05 06:31 UTC

Only Available for Registered Users. Sign in to view.