TF-1931115
high
📛 Threat Title
Unknown Stealer: Domain name that delivers a malware payload chilloutvrmod.org
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Stealer. Confidence: 100. First seen: 2026-09-23 23:47:52 UTC. Reporter: NekoPunchii. Tags: ANTIVM, spyware, stealer.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
chilloutvrmod.org
IOC database
- Type
- domain
- Value
chilloutvrmod.org- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to Unknown Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- External reference ThreatFox IOCs
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Stealer. Confidence: 100. First seen: 2026-09-23 23:47:52 UTC. Reporter: NekoPunchii. Tags: ANTIVM, spyware, stealer.
Remediations (10)
-
web:radar.cloudflare.com
Understand the security, performance, technology, and network details of a URL with a publicly shareable report.
-
web:socradar.io
Void Stealer : The Infostealer Malware Quietly Targeting Organizations in 2026 Void Stealer is an infostealer malware that emerged in late 2025 and has been running active campaigns against users and organizations ever since. Distributed under a Malware - as -a-Service (MaaS) model through Telegram channels and underground forum s, it allows any operator to deploy credential-stealing campaigns for ...
-
web:thehackernews.com
WordlistLoader delivers Amatera via ClearFake ClickFix attacks, while SynkLoader uses Teams phishing to steal Windows login credentials.
-
web:www.csa.gov.sg
Impact Successful execution of the ClickFix technique can lead to the deployment of various malware families, including the DCRAT, NetSupport RAT, Latrodectus, and Lumma Stealer , resulting in credential theft, data exfiltration, email account compromise, and potential ransomware incidents.
-
web:www.csoonline.com
The WordPress ClickFix campaign delivers three separate infostealer payloads — two of them previously unknown — and uses domain infrastructure that appears to have been set up since July 2025.
-
web:www.elastic.co
Elastic Security Labs detected a surge in ClickFix campaigns, using GHOSTPULSE to deploy Remote Access Trojans and data-stealing malware .
-
web:www.malwarebytes.com
We found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware .
-
web:www.microsoft.com
These commands, which are purported to install system utilities, load an infostealing malware like Macsync, Shub Stealer , and AMOS into the targets' devices instead. The malware then collects and exfiltrates data, including media files, iCloud data and Keychain entries, and cryptocurrency wallet keys.
-
web:www.microsoft.com
From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments.
-
web:www.rapid7.com
Rapid7 Labs has identified an ongoing, widespread compromise of legitimate WordPress websites, misused by an unidentified threat actor to inject a ClickFix implant (impersonating a Cloudflare human verification challenge [CAPTCHA]). The lure can be used for financial theft or to conduct further, more targeted attacks against organizations.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.