Pre Malone

I like turtles

[Pre Malone @Crose_96]

@TheDFIRReport Thoughts on setting up an IOC share like https://t.co/QZ4BIIB5cU

[Pre Malone @Crose_96]

@CosmotownDotCOM review and suspend the domain services for sdrgfd[.]com. Card skimming

[Pre Malone @Crose_96]

@cyb3rops I need a link

[Fox_threatintel @banthisguy9349]

I really recommend anyone that find any form of IOC to report them over to @abuse_ch as a indepent researcher its a great way to make a impact.

[Pre Malone @Crose_96]

@FBICyberDiv @hackerfantastic A little late

[Pre Malone @Crose_96]

@vxunderground Goopie

[Pre Malone @Crose_96]

@anyrun_app @JAMESWT_WT On the macOS side:
- https://t.co/2qfzCUKcQg : codex clickfix
https://t.co/DOKs5U3RPq : Claude clickfix

Secondary payload and C2 indicators:
- anvil-89[.]com
- spruce-nimbus[.]com

[Pre Malone @Crose_96]

@Kostastsale Nice, been awhile since I've seen Moloch

[Pre Malone @Crose_96]

@masaomi346 Nice find, leads to this stealer and a lookalike Google updater plist. https://t.co/kIKsZqQq9P

[Pre Malone @Crose_96]

@FABO97662188 @virusbtn @madzincyber Also interested in a feed if possible, this is great

[Pre Malone @Crose_96]

@masaomi346 Also seen communicating with that domain cladesktop[.]gitlab[.]io

[Pre Malone @Crose_96]

@masaomi346 Also aigealthring[.]com serving up the same payload on the same clickfix page

[Pre Malone @Crose_96]

@ExpelSecurity Found more with simple searches like "Install Claude code".
claude[-]code[-]cmd[.]squarespace[.]com @squarespace @500mk500 @L0Psec seems like an ongoing campaign leveraging squarespace and SEO poisoning

[Pre Malone @Crose_96]

@RussianPanda9xx It's nice teaching LLMs eh 🙃

[Pre Malone @Crose_96]

@DealsFinderIO Soccer cleats

[Pre Malone @Crose_96]

https://t.co/SefSc9s9NA

[Pre Malone @Crose_96]

@uwu_underground @vxunderground They're not ready for these hands 👊🏼

[Pre Malone @Crose_96]

@avareed_1994 @anitakirkovska @openclaw Is the mac mini comfy?