TF-1933762 high

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-25 16:07:22 UTC. Reporter: varysz. Tags: etherhiding, victim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-25 16:07:22 UTC. Reporter: varysz. Tags: etherhiding, victim.

• One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader ...
  web:blog.sicuranext.com

  EtherHiding: blockchain-based payload delivery Two seconds after the page loaded, the injected JavaScript initiated outbound queries to the BNB Smart Chain (BSC) Testnet. The BSC Testnet (Chain ID 97) is a free-to-use Ethereum Virtual Machine-compatible blockchain.

  2026-09-25 21:09 UTC
• IOC Alert: unknown_loader Payload Delivery
  web:darkwebinformer.com

  A new domain -based indicator has been identified associated with payload delivery activity tied to the malware unknown_loader . This domain , advertised under the guise of a mobile advertising and monetization platform, poses a high-confidence threat to users and organizations.

  2026-09-25 21:09 UTC
• Common Malware Loaders - ReliaQuest
  web:reliaquest.com

  Learn about the role of malware loaders in cybercriminal campaigns, their distribution methods, and strategies for detection and mitigation .

  2026-09-25 21:09 UTC
• DeepLoad Malware Pairs ClickFix Delivery with AI-Generated Evasion
  web:reliaquest.com

  "DeepLoad" malware has arrived in enterprise environments via "ClickFix" delivery, turning one user action into rapid, fileless compromise. It likely uses AI-assisted obfuscation and process injection to evade static scanning, while credential theft starts immediately and captures passwords and sessions even if the primary loader is ...

  2026-09-25 21:09 UTC
• Cruciferra Malware Loader Kills EDR via ClickFix
  web:securityonline.info

  eSentire ties the Cruciferra malware loader to ClickFix EDR killer attacks that abuse a signed driver to stop 145 security processes.

  2026-09-25 21:09 UTC
• ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake ...
  web:thehackernews.com

  ClickFix attacks are delivering BabaDeda, Lorem Ipsum, and Potemkin loaders to deploy stealers, RATs, and ransomware-linked tooling.

  2026-09-25 21:09 UTC
• WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes ...
  web:thehackernews.com

  WordlistLoader delivers Amatera via ClearFake ClickFix attacks, while SynkLoader uses Teams phishing to steal Windows login credentials.

  2026-09-25 21:09 UTC
• Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your ...
  web:www.esentire.com

  eSentire's TRU uncovered Cruciferra, an EDR-killing malware loader delivered via ClickFix campaigns using a vulnerable signed driver. Read the full threat analysis.

  2026-09-25 21:09 UTC
• Fake Google and Cloudflare verification pages spread multiple malware ...
  web:www.malwarebytes.com

  We uncovered ClickFix attacks using fake Google and Cloudflare pages to deliver everything from infostealers to a newly discovered malware loader .

  2026-09-25 21:09 UTC
• ClickFix HijackLoader Phishing Campaign Analysis | Seqrite
  web:www.seqrite.com

  Unlike simple payloads , loaders are engineered with a dedicated purpose: to circumvent security defenses, establish persistence, and create a favorable environment for the hidden execution of the final-stage malware . This makes them a more significant and relevant threat that demands focused analysis.

  2026-09-25 21:09 UTC

Only Available for Registered Users. Sign in to view.