Top Tweets for #MintsLoader
Heads up – we’re doing a webinar this Thursday on Domain Search + PADNS early detection, with a few real-world examples from #Kimsuky, #TA2726, and #Mintsloader investigations.
Register here 👉 https://t.co/A4UBrPZOW4
🇮🇹 Riprendono le attività delle campagne #MintsLoader
⚠️ Dopo una lunga pausa estiva, nella giornata di ieri è stata osservata una nuova campagna #MintsLoader via #PEC, la prima dopo quella registrata lo scorso giugno.
ℹ️ Approfondimenti e #IoC 👇
🔗 https://t.co/T1RnYNGW32
➡️ Individuata una nuova campagna ita #MintsLoader tramite messaggi inviati da caselle #PEC compromesse
➡️ Rilevata una nuova campagna di smishing ai danni di #INPS, finalizzata alla sottrazione di dati e documenti personali
➡️ Continua phishing con nome e il logo di #PagoPA
🧀 Update on MintsLoader: a thread 🔽
MintsLoader is a JavaScript/PowerShell loader that was first detailed by OCD in 2024.
A new version has been around at least since early-June 2025.
#cti #ThreatIntel #mintsloader
#ThreatProtection #MintsLoader #Malware #Campaign hits Italian PEC users with Calendar-aware tactics. Read more about Symantec's protection: https://t.co/M1TGeqfwuV #Cybercrime #Cybersecurity
🇮🇹 Nuova campagna #MintsLoader conferma una mirata strategia temporale
🔎 Colpire esclusivamente nelle giornate feriali, quando gli utenti sono più inclini a consultare le email lavorative, specialmente se a seguito di una pausa.
🔗 https://t.co/wIJYzmBTDs
#MintsLoader > #PEC #Italy
👇
brettesxes.]com/1.php?s=flibabc12
abckdkfkgdjnkhe.]top/zeqvk8x13ghtr.php
Samples👇 @luc4m
https://t.co/cpKeZi6M77
#MintsLoader #Spain
geronimo.]website/1.php?s=flibabc12
glmhhdcmgcfddbk.]top/upow4fi5hvhtr.php
❇️Summary
https://t.co/qMgrhHRIoF
![JAMESWT_WT's tweet photo. #MintsLoader > #PEC #Italy
👇
brettesxes.]com/1.php?s=flibabc12
abckdkfkgdjnkhe.]top/zeqvk8x13ghtr.php
Samples👇 @luc4m
https://t.co/cpKeZi6M77
#MintsLoader #Spain
geronimo.]website/1.php?s=flibabc12
glmhhdcmgcfddbk.]top/upow4fi5hvhtr.php
❇️Summary
https://t.co/qMgrhHRIoF https://t.co/RsjlCW8hNQ](https://pbs.twimg.com/media/GsllgJRW0AAg8_G.jpg)
![JAMESWT_WT's tweet photo. #MintsLoader > #PEC #Italy
👇
brettesxes.]com/1.php?s=flibabc12
abckdkfkgdjnkhe.]top/zeqvk8x13ghtr.php
Samples👇 @luc4m
https://t.co/cpKeZi6M77
#MintsLoader #Spain
geronimo.]website/1.php?s=flibabc12
glmhhdcmgcfddbk.]top/upow4fi5hvhtr.php
❇️Summary
https://t.co/qMgrhHRIoF https://t.co/RsjlCW8hNQ](https://pbs.twimg.com/media/GsllfN8XcAAig9_.jpg)
![JAMESWT_WT's tweet photo. #MintsLoader > #PEC #Italy
👇
brettesxes.]com/1.php?s=flibabc12
abckdkfkgdjnkhe.]top/zeqvk8x13ghtr.php
Samples👇 @luc4m
https://t.co/cpKeZi6M77
#MintsLoader #Spain
geronimo.]website/1.php?s=flibabc12
glmhhdcmgcfddbk.]top/upow4fi5hvhtr.php
❇️Summary
https://t.co/qMgrhHRIoF https://t.co/RsjlCW8hNQ](https://pbs.twimg.com/media/Gslld0dW0AEQGmc.jpg)
Related
"#MintsLoader: #StealC and BOINC"
samples covered
👇
https://t.co/GG6dzeIjzA
extra
https://t.co/l8md83HDom
Boinc
https://t.co/tHyXENX3UM
Some #MintsLoader + "temp" url in common
11/2024
4c45dcb97fd466caca3ad9a556b2367148fe497b3055bddd378876272f2ad957
01/2025
https://t.co/3g8KDuiPzY
04/2025
3B84447288C2F0D93F40EB745E1126DC947D0DEFBDBE1BF1D62BFAD5B67031E4
Some #MintsLoader + "temp" url in common
11/2024
4c45dcb97fd466caca3ad9a556b2367148fe497b3055bddd378876272f2ad957
01/2025
https://t.co/3g8KDuiPzY
04/2025
3B84447288C2F0D93F40EB745E1126DC947D0DEFBDBE1BF1D62BFAD5B67031E4
Mentioned #MintsLoader via #Italy #PEC Samples
👇
https://t.co/IwmUfYAu4p
⛔️C2
lknafbafiiclfgl[.]top
sdfjkhgyu6wjkhlasyhd[.]op
![JAMESWT_WT's tweet photo. Mentioned #MintsLoader via #Italy #PEC Samples
👇
https://t.co/IwmUfYAu4p
⛔️C2
lknafbafiiclfgl[.]top
sdfjkhgyu6wjkhlasyhd[.]op https://t.co/92dJvRcLGc](https://pbs.twimg.com/media/GqU9ifaW4AAhsnj.jpg)
🇮🇹 Nuova campagna #MintsLoader diffonde il malware #Stealc attraverso caselle #PEC compromesse
🎯 #Stealc infostealer (MaaS)
➡️ browser
➡️ estensioni
➡️ wallet di criptovalute
➡️ client email
➡️ altre applicazioni
ℹ️ Approfondimenti e #IoC 👇
🔗 https://t.co/uIgqdH1wwy
🇮🇹 Nuova campagna #MintsLoader diffonde il malware #Stealc attraverso caselle #PEC compromesse
🎯 #Stealc infostealer (MaaS)
➡️ browser
➡️ estensioni
➡️ wallet di criptovalute
➡️ client email
➡️ altre applicazioni
ℹ️ Approfondimenti e #IoC 👇
🔗 https://t.co/uIgqdH1wwy
Experts shared up-to-date C2 domains and other artifacts related to recent #MintsLoader Attacks
https://t.co/ATHxh5bn7g
#securityaffairs #hacking #malware
@TheRecord_Media
#MintsLoader Drops #GhostWeaver via Phishing, ClickFix — Uses DGA, TLS for Stealth Attacks
https://t.co/FHwDQATQ3W
#ThreatProtection #MintsLoader fuels stealthy attacks with AntiVM tactics, obfuscated scripts and rotating C2 domains. Read more about Symantec's protection: https://t.co/kTnwE6LTjt #Malware
🇮🇹 Nuova ondata malevola via #PEC: MintsLoader ora distribuisce #AsyncRat
✉️ Comunicazione di sollecito per il pagamento [Ragione Sociale]
⚔️ TTP: JS + PS1 #MintsLoader
ℹ️ Approfondimenti e #IoC 👇
🔗 https://t.co/HDILc1mraK
![AgidCert's tweet photo. 🇮🇹 Nuova ondata malevola via #PEC: MintsLoader ora distribuisce #AsyncRat
✉️ Comunicazione di sollecito per il pagamento [Ragione Sociale]
⚔️ TTP: JS + PS1 #MintsLoader
ℹ️ Approfondimenti e #IoC 👇
🔗 https://t.co/HDILc1mraK https://t.co/yMbryZlFjH](https://pbs.twimg.com/media/Gm5UAs6XwAA9bYw.jpg)
Deobfuscated second stage #MintsLoader used in malspam campaign
📦S1:
p://<DGA_DOMAIN>.top/1.php?s=flibabc11
📦S2:
p://<DGA_DOMAIN>.top/<RANDOM_CHAR>htr.php?id=<VICTIM_HOSTNAME>&key=<FLAG_ID>&s=flibabc11
🧐High similarity:
https://t.co/3g8KDujnpw
🍬 Daily dose of #MintsLoader C2s, registered yesterday:
dlghjjhdchbkjbd[.]top
sekawctenilfkgp[.]top
lbbkbinkemlhein[.]top
IOC farming time... 🐮
🍬 Potentially newly registered #MintsLoader domains:
bgllakndcidgcnj[.]top
daedfjkgnikkbkb[.]top
gnbmanbacedkgaj[.]top
nuuhhcfenjoywca[.]top
🌎 New web inject URL (#UNC4108):
query-js-ajax[.]com
👻 #GhostWeaver C2:
wu2qmpa2vndlnhb[.]top
Daily dose of potential #MintsLoader domains registered yesterday:
kdljlignmgemecf[.]top
usdgyzjey4h[.]top
mioasfybz7y4[.]top
nfuagy7fgus[.]top
l284afj165tqz51[.]top
icciilhkbdgjggn[.]top
anccvfsrkauefoh[.]top
Last Seen Hashtags on Sotwe
teenagee https,
Seen from Brazil
HORSECOCK
Seen from United Kingdom
Rumboalmediomaraton
Seen from United States
CAVSulas
Seen from United States
exposed
Seen from Canada
AIart
Seen from Poland
BJPFirstChoice
Seen from United States
agegap
Seen from United States
TerceraT
Seen from Sweden
gapang lasing
Seen from Netherlands
Most Popular Users
Elon Musk 
@elonmusk
240.8M followers
Barack Obama
@barackobama
119.2M followers
Donald J. Trump
@realdonaldtrump
111.7M followers
Cristiano Ronaldo
@cristiano
111M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
97.8M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91M followers
KATY PERRY
@katyperry
87.9M followers
Taylor Swift
@taylorswift13
81.7M followers
Lady Gaga
@ladygaga
73.3M followers
Virat Kohli
@imvkohli
70.3M followers
Kim Kardashian
@kimkardashian
69.9M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64M followers
Neymar Jr
@neymarjr
63.1M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.9M followers
Selena Gomez
@selenagomez
61M followers
X
@x
60.8M followers