TF-1815111 medium

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Stealer. Confidence: 50. First seen: 2026-05-17 05:49:55 UTC. Reporter: varysz.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Stealer. Confidence: 50. First seen: 2026-05-15 18:56:59 UTC. Reporter: varysz.

• Strela Stealer Delivered Over DNS TXT by New 'Detour Dog' Campaign
  web:cyberpress.org

  Detour Dog, a persistent threat actor tracked since February 2020, has executed an unprecedented campaign leveraging server-side DNS TXT record queries to conditionally redirect site visitors and deliver multi-stage malware , most notably Strela Stealer , across tens of thousands of compromised websites worldwide.

  2026-05-22 02:02 UTC
• New DNS Malware Detour Dog Delivers Strela Stealer Using DNS TXT Records
  web:cybersecuritynews.com

  A sophisticated DNS-based malware campaign has emerged, utilizing thousands of compromised websites worldwide to deliver the Strela Stealer information-stealing malware through an unprecedented technique involving DNS TXT records. The threat, tracked as Detour Dog by security researchers, represents a significant evolution in malware distribution methods that leverages the Domain Name System ...

  2026-05-22 02:02 UTC
• New DNS Malware 'Detour Dog' Uses TXT Records to Deliver Strela Stealer
  web:gbhackers.com

  Detour Dog, a stealthy website malware campaign tracked since August 2023, has evolved from redirecting victims to tech-support scams into a sophisticated DNS-based command-and-control (C2) distribution system that delivers the Strela Stealer information stealer via DNS TXT records.

  2026-05-22 02:02 UTC
• Infostealer Malware Detected Risk - help.upguard.com
  web:help.upguard.com

  Infostealer Malware Detected Risk Indicates that credentials linked to a monitored domain were found in known infostealer malware data leaks. The Infostealer Malware Detected risk identifies when UpGuard has observed one or more email addresses to a monitored primary domain in known infostealer malware data leaks.

  2026-05-22 02:02 UTC
• Detour Dog: Stealthy DNS Malware Uses TXT Records for Command and Control
  web:securityonline.info

  The Infoblox Threat Intelligence team has released an in-depth report on a global malware campaign leveraging the Domain Name System (DNS) to distribute malicious payloads and evade detection. The threat actor behind the operation, tracked as Detour Dog, has infected tens of thousands of websites worldwide, using DNS TXT records as a novel command-and-control (C2) mechanism. Unlike traditional ...

  2026-05-22 02:02 UTC
• Stealer Logs: Everything You Need to Know - socradar.io
  web:socradar.io

  The theft of user credentials, browser data, and personal information has become industrialized, and much of it starts with stealer logs. Every day, millions of stolen records from infostealer malware infections are compiled into organized, searchable files, fueling a surge in account takeovers, corporate breaches, and financial fraud.

  2026-05-22 02:02 UTC
• Stealthy Malware Delivery via DNS TXT Records: Detection and Mitigation
  web:undercodetesting.com

  Introduction: Cybercriminals are increasingly abusing DNS TXT records to deliver malware and command-and-control (C2) payloads covertly. A recent investigation by DomainTools revealed how attackers fragment, hex-encode, and distribute malicious code across multiple DNS queries, evading traditional security measures.

  2026-05-22 02:02 UTC
• Stealer Malware and Stealer Logs Explained - CYJAX
  web:www.cyjax.com

  Stealer logs and the infostealers that harvest them form a key part of the threat landscape and cybercriminal ecosystem. Infostealers, which are also referred to as stealer malware , are deployed by threat actors to facilitate data theft from compromised devices.

  2026-05-22 02:02 UTC
• Deep Dive into Infostealer Payloads: Understanding the Threat
  web:www.linkedin.com

  The escalating infostealer epidemic demands a far more granular understanding than surface-level defenses can provide. While our previous discussion highlighted the broad strokes of this threat ...

  2026-05-22 02:02 UTC
• Lumma Stealer: Breaking down the delivery techniques and capabilities ...
  web:www.microsoft.com

  Over the past year, Microsoft Threat Intelligence observed the persistent growth and operational sophistication of Lumma Stealer , an info-stealing malware used by multiple financially motivated threat actors to target various industries. Microsoft, partnering with others across industry and international law enforcement, facilitated the disruption of Lumma infrastructure.

  2026-05-22 02:02 UTC

Only Available for Registered Users. Sign in to view.