TF-1933807
high
📛 Threat Title
Unknown Loader: Domain name that delivers a malware payload telepathisches-medium.com
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-25 16:07:27 UTC. Reporter: varysz. Tags: etherhiding, victim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
telepathisches-medium.com
VT 3 / 91
UrlVoid 3 / 36
IOC database
- Type
- domain
- Value
telepathisches-medium.com- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Ingested from IOC source: https://threatfox.abuse.ch/downloads/hostfile/
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 3 of 91 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| CRDF | malicious | malicious |
| Gridinsoft | suspicious | suspicious |
| SOCRadar | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| TLD | com |
History
| Creation date | 2026-01-28 00:00 UTC |
| Last analysis | 2026-09-25 17:18 UTC |
| Last modified on VirusTotal | 2026-09-26 00:21 UTC |
| Last WHOIS update | 2026-02-23 00:00 UTC |
| WHOIS record date | 2027-01-28 00:00 UTC |
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: Unknown Loader. Confidence: 75. First seen: 2026-09-25 16:07:27 UTC. Reporter: varysz. Tags: etherhiding, victim.
Remediations (10)
-
web:blog.sicuranext.com
A real-world ClickFix intrusion observed from both sandbox and endpoint telemetry, revealing the complete attack path from a compromised WordPress site to a blocked GULoader execution, including a full process creation call stack from the Windows Run dialog to the kernel.
-
web:cybersecuritynews.com
The malware is designed to stay small at first, then download extra features when needed. That approach lets operators add information-stealing, keystroke logging, browser manipulation, and other functions without placing every capability in the initial file. ClickFix Campaign Delivers Modular TELEPUZ Malware TELEPUZ communicates with its command-and-control server through WebSockets, using a ...
-
web:darkwebinformer.com
A new domain -based indicator has been identified associated with payload delivery activity tied to the malware unknown_loader . This domain , advertised under the guise of a mobile advertising and monetization platform, poses a high-confidence threat to users and organizations.
-
web:securityonline.info
TL;DR Elastic Security Labs is tracking a new modular malware family called TELEPUZ. Attackers deliver it through a ClickFix page that leads to VIDAR, which then drops the real payload . The malware pulls its features down as separate modules and talks to its server over WebSockets. Delivery starts with a ClickFix attack The chain opens with social engineering, not an exploit. A victim lands on ...
-
web:thehackernews.com
Microsoft details a new ClickFix variant abusing DNS nslookup commands to stage malware , enabling stealthy payload delivery and RAT deployment.
-
web:thehackernews.com
The payload is gated on machine identity The third finding is the one that should change how teams interpret their tooling. In the dropper recovered from the live host, a hardware and account fingerprint machine GUID, volume serial, computer name , BIOS manufacturer, system model, GPU and username is base64-encoded directly into the download path.
-
web:www.malwarebytes.com
We uncovered ClickFix attacks using fake Google and Cloudflare pages to deliver everything from infostealers to a newly discovered malware loader .
-
web:www.malwarebytes.com
We found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware .
-
web:www.microsoft.com
Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance.
-
web:www.rapid7.com
Rapid7 Labs has identified an ongoing, widespread compromise of legitimate WordPress websites, misused by an unidentified threat actor to inject a ClickFix implant (impersonating a Cloudflare human verification challenge [CAPTCHA]). The lure can be used for financial theft or to conduct further, more targeted attacks against organizations.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.