s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2019957 high

📛 Threat Title

WARDENStealer: URL that delivers a malware payload https://raw.githubusercontent.com/AttriKartik123/AceServe-Trainer-TennisManager2…

Category: WARDENStealer Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: WARDENStealer. Confidence: 75. First seen: 2026-11-08 07:26:57 UTC. Reporter: wristhulk. Tags: Github, lure, mediafire, WARDENStealer.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

url https://raw.githubusercontent.com/attrikartik123/aceserve-trainer-tennismanager25/main/l%d0%beader.zip

IOC database

Type
url
Value
https://raw.githubusercontent.com/attrikartik123/aceserve-trainer-tennismanager25/main/l%d0%beader.zip
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
URL that delivers a malware payload attributed to WARDENStealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (3)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: WARDENStealer. Confidence: 75. First seen: 2026-11-08 07:26:57 UTC. Reporter: wristhulk. Tags: Github, lure, mediafire, WARDENStealer.

  • External reference ThreatFox IOCs

Remediations (10)

  • GitHub - danielmiessler/SecLists: SecLists is the security tester's ...
    web:github.com

    SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs , sensitive data patterns, fuzzing payloads , web shells, and many more. The goal is to enable a security tester to pull this repository onto a new testing box and have access to every type of list that ...

  • Threat-Remediation-Scripts - GitHub
    web:github.com

    The following library contains a collection of remediation scripts designed to remove common unwanted software, adware, and malware found in the wild. If you come across a particular program you'd like to remediate, feel free to download the corresponding script and use it in your environment.

  • OpenSourceMalware.com - Community Threat Intelligence
    web:opensourcemalware.com

    Community-driven threat intelligence. Human-verified supply chain threats from every major open source ecosystem.

  • URL Scanner - Cloudflare Radar
    web:radar.cloudflare.com

    Understand the security, performance, technology, and network details of a URL with a publicly shareable report.

  • Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead ...
    web:research.jfrog.com

    JFrog Security Research identified two hijacked npm packages, `html-to-gutenberg` and `fetch-pacage-assets`, that used a hidden VS Code task to launch a multi-stage malware chain. The payloads used blockchain transaction data as dead drops, installed JavaScript and Python runtime components, and deployed a backdoor and infostealer targeting credentials, browsers, wallets, developer tools, and ...

  • Warden Stealer Rust Infostealer Hits AI Coding Agents
    web:securityonline.info

    Warden Stealer, a fast-growing Rust infostealer, steals AI agent tokens, browser data, and crypto while bundling its own loader and clipper.

  • URLhaus | Malware URL exchange
    web:urlhaus.abuse.ch

    URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  • URLhaus | Browse - abuse.ch
    web:urlhaus.abuse.ch

    URLhaus Database Here you can propose new malware urls or just browse the URLhaus database. If you are looking for a parsable list of the dataset, you might want to check out the URLhaus API. There are 3'998'377 malicious URLs tracked on URLhaus. The queue size is 69. Report a malware URL

  • GitHub-hosted malware campaign uses split payload to evade detection
    web:www.helpnetsecurity.com

    A large-scale malware delivery campaign has been targeting developers, gamers, and general users through fake tools hosted on GitHub.

  • Malvertising campaign leads to info stealers hosted on GitHub
    web:www.microsoft.com

    Microsoft detected a large-scale malvertising campaign in early December 2024 that impacted nearly one million devices globally. The attack originated from illegal streaming websites embedded with malvertising redirectors and ultimately redirected users to GitHub to deliver initial access payloads as the start of a modular and multi-stage attack chain.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.