TF-1821476 high

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Stealer. Confidence: 100. First seen: 2026-06-02 19:41:13 UTC. Reporter: ninjacatcher. Tags: infostealer, stealer.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Stealer. Confidence: 100. First seen: 2026-06-02 19:41:13 UTC. Reporter: ninjacatcher. Tags: infostealer, stealer.

• New DNS Malware Detour Dog Delivers Strela Stealer Using DNS TXT Records
  web:cybersecuritynews.com

  A sophisticated DNS-based malware campaign has emerged, utilizing thousands of compromised websites worldwide to deliver the Strela Stealer information-stealing malware through an unprecedented technique involving DNS TXT records. The threat, tracked as Detour Dog by security researchers, represents a significant evolution in malware distribution methods that leverages the Domain Name System ...

  2026-06-03 22:24 UTC
• New DNS Malware 'Detour Dog' Uses TXT Records to Deliver Strela Stealer
  web:gbhackers.com

  Detour Dog, a stealthy website malware campaign tracked since August 2023, has evolved from redirecting victims to tech-support scams into a sophisticated DNS-based command-and-control (C2) distribution system that delivers the Strela Stealer information stealer via DNS TXT records.

  2026-06-03 22:24 UTC
• Infostealer Malware Detected Risk - help.upguard.com
  web:help.upguard.com

  The Infostealer Malware Detected risk identifies when UpGuard has observed one or more email addresses to a monitored primary domain in known infostealer malware data leaks. Infostealer malware is malicious software installed on a computer - often through phishing, malicious downloads, or fake software updates - that steals data and credentials stored on the machine. This can include saved ...

  2026-06-03 22:24 UTC
• Malware Discoverer -- Automatic Malicious Site and Payload Discovery
  web:malwarediscoverer.com

  Discover domain abuse before they impact real users Malicious URL redirection leads to malware , phishing and scam. Waiting for real users to report domain abuse is slow. Our proactive system discovers URL redirections without human interference.

  2026-06-03 22:24 UTC
• PhantomVAI Loader Delivers a Range of Infostealers
  web:unit42.paloaltonetworks.com

  PhantomVAI is a new loader used to deploy multiple infostealers. We discuss its overall evolution and use of steganography and obfuscated scripts.

  2026-06-03 22:24 UTC
• URLhaus | Malware URL exchange
  web:urlhaus.abuse.ch

  URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  2026-06-03 22:24 UTC
• Stop Malware Distribution - DefendDomain
  web:www.defenddomain.com

  Ransomware costs organisations $4.54 million per incident on average — and 71% of malware distribution campaigns use lookalike domains to deliver their payloads . We detect the fake download infrastructure before it delivers a single payload . DefendDomain monitors for lookalike domains hosting malicious files, fake software update pages, and SSL certificates that make dangerous downloads look ...

  2026-06-03 22:24 UTC
• Filescan.io - Next-Gen Malware Analysis Platform
  web:www.filescan.io

  Submit malware for analysis on this next-gen malware assessment platform. Filescan GmbH develops and licenses technology to fight malware with a focus on Indicator-of-Compromise (IOC) extraction at scale.

  2026-06-03 22:24 UTC
• Malicious URL Scanner | Scan URLs for Malware | URL Checker
  web:www.ipqualityscore.com

  Scan URLs for malware and phishing with our free malicious URL scanner. Check links in real-time to detect suspicious domains and prevent cyber threats.

  2026-06-03 22:24 UTC
• VirusTotal - Home
  web:www.virustotal.com

  VirusTotal Assistant Bot offers a platform for users to interact with VirusTotal's threat intelligence suite and explore artifact-related information effectively.

  2026-06-03 22:24 UTC

Only Available for Registered Users. Sign in to view.