TF-1815118 medium

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Stealer. Confidence: 50. First seen: 2026-05-17 05:50:14 UTC. Reporter: varysz.

Indicators of Compromise (2)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Stealer. Confidence: 50. First seen: 2026-05-15 19:02:40 UTC. Reporter: varysz.

• Hunting Infostealers - Trusted Platform Abuse - Azure Feeds
  web:azurefeeds.com

  Mitigation and protection guidance Microsoft recommends the following mitigations to reduce the impact of trusted platform abuse used to deliver infostealers as discussed in this report. These recommendations draw from established Defender blog guidance patterns and align with protections offered across Microsoft Defender XDR.

  2026-05-22 02:02 UTC
• Katz Stealer Malware Targets Browsers Wallets and Messaging Platforms
  web:cybersecsentinel.com

  This report delivers a detailed threat assessment on Katz Stealer , an emerging credential stealer operating as a Malware - as -a-Service (MaaS). Since its appearance in May 2025, Katz Stealer has leveraged a sophisticated infection chain, targeting browsers, cryptocurrency wallets, communications platforms, and gaming services.

  2026-05-22 02:02 UTC
• New DNS Malware Detour Dog Delivers Strela Stealer Using DNS TXT Records
  web:cybersecuritynews.com

  A sophisticated DNS-based malware campaign has emerged, utilizing thousands of compromised websites worldwide to deliver the Strela Stealer information-stealing malware through an unprecedented technique involving DNS TXT records. The threat, tracked as Detour Dog by security researchers, represents a significant evolution in malware distribution methods that leverages the Domain Name System ...

  2026-05-22 02:02 UTC
• Stealer Logs - Flare | Threat Exposure Management | Unmatched ...
  web:flare.io

  The timeline of stealer malware infections offers a great look into the evolution of the threat. Analyzing millions of stealer logs, we gain insights into how these stealers have proliferated over time. By examining infection dates from Flare's stealer logs, we can trace the trajectory of various malware families over the last 5 years.

  2026-05-22 02:02 UTC
• New DNS Malware 'Detour Dog' Uses TXT Records to Deliver Strela Stealer
  web:gbhackers.com

  Detour Dog, a stealthy website malware campaign tracked since August 2023, has evolved from redirecting victims to tech-support scams into a sophisticated DNS-based command-and-control (C2) distribution system that delivers the Strela Stealer information stealer via DNS TXT records.

  2026-05-22 02:02 UTC
• Infostealer Malware Detected Risk - help.upguard.com
  web:help.upguard.com

  Infostealer Malware Detected Risk Indicates that credentials linked to a monitored domain were found in known infostealer malware data leaks. The Infostealer Malware Detected risk identifies when UpGuard has observed one or more email addresses to a monitored primary domain in known infostealer malware data leaks.

  2026-05-22 02:02 UTC
• The Unknown Stealers: What's Hidden Below the Radar
  web:socradar.io

  The Malware - as -a-Service (MaaS) model has turned stealer development into a commercial operation that mirrors legitimate SaaS businesses, complete with tiered pricing, customer support SLAs, changelogs, and affiliate programs.

  2026-05-22 02:02 UTC
• URLhaus | Malware URL exchange
  web:urlhaus.abuse.ch

  URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  2026-05-22 02:02 UTC
• Lumma Stealer: Breaking down the delivery techniques and capabilities ...
  web:www.microsoft.com

  Over the past year, Microsoft Threat Intelligence observed the persistent growth and operational sophistication of Lumma Stealer , an info-stealing malware used by multiple financially motivated threat actors to target various industries. Microsoft, partnering with others across industry and international law enforcement, facilitated the disruption of Lumma infrastructure.

  2026-05-22 02:02 UTC
• VirusTotal - Home
  web:www.virustotal.com

  VirusTotal Assistant Bot offers a platform for users to interact with VirusTotal's threat intelligence suite and explore artifact-related information effectively.

  2026-05-22 02:02 UTC

Only Available for Registered Users. Sign in to view.