TF-1933772 high

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-25 16:07:24 UTC. Reporter: varysz. Tags: etherhiding, victim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-25 16:07:24 UTC. Reporter: varysz. Tags: etherhiding, victim.

• One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader ...
  web:blog.sicuranext.com

  EtherHiding: blockchain-based payload delivery Two seconds after the page loaded, the injected JavaScript initiated outbound queries to the BNB Smart Chain (BSC) Testnet. The BSC Testnet (Chain ID 97) is a free-to-use Ethereum Virtual Machine-compatible blockchain.

  2026-09-25 21:10 UTC
• IOC Alert: unknown_loader Payload Delivery
  web:darkwebinformer.com

  A new domain -based indicator has been identified associated with payload delivery activity tied to the malware unknown_loader . This domain , advertised under the guise of a mobile advertising and monetization platform, poses a high-confidence threat to users and organizations.

  2026-09-25 21:10 UTC
• Understanding the ClickFix Malware Loader Threat
  web:femtosec.io

  Analysis of the ClickFix loader emerging on underground forums. Learn how this malware deployment tool impacts enterprise security and how to mitigate the risk.

  2026-09-25 21:10 UTC
• Unknown Loader malware — IOCs & CVEs | isMalicious
  web:ismalicious.com

  4,553 indicators of compromise attributed to the Unknown Loader malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.

  2026-09-25 21:10 UTC
• DeepLoad Malware Pairs ClickFix Delivery with AI-Generated Evasion
  web:reliaquest.com

  "DeepLoad" malware has arrived in enterprise environments via "ClickFix" delivery, turning one user action into rapid, fileless compromise. It likely uses AI-assisted obfuscation and process injection to evade static scanning, while credential theft starts immediately and captures passwords and sessions even if the primary loader is ...

  2026-09-25 21:10 UTC
• DOUBLECUP ClickFix Loader Delivers CountLoader and ... - RH-ISAC
  web:rhisac.org

  The malware provides operators with persistence, system reconnaissance, command execution, payload delivery, and resilient command and control capabilities. Key Takeaways DOUBLECUP is a Russian Loader - as -a-Service developed for ClickFix campaigns and has operated since early June 2026.

  2026-09-25 21:10 UTC
• Cruciferra Malware Loader Kills EDR via ClickFix
  web:securityonline.info

  eSentire ties the Cruciferra malware loader to ClickFix EDR killer attacks that abuse a signed driver to stop 145 security processes.

  2026-09-25 21:10 UTC
• Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for ...
  web:thehackernews.com

  Microsoft details a new ClickFix variant abusing DNS nslookup commands to stage malware , enabling stealthy payload delivery and RAT deployment.

  2026-09-25 21:10 UTC
• Criminals turn placeholder domain into ClickFix trap
  web:www.malwarebytes.com

  A domain used in software examples—third-party[.]com—now serves up a fake verification page that tells Windows users to run a PowerShell command.

  2026-09-25 21:10 UTC
• Tracking PavinLoader across ClickFix and fake download campaigns
  web:www.malwarebytes.com

  We found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware .

  2026-09-25 21:10 UTC

Only Available for Registered Users. Sign in to view.