Top Tweets for #Mintsloader
Heads up – we’re doing a webinar this Thursday on Domain Search + PADNS early detection, with a few real-world examples from #Kimsuky, #TA2726, and #Mintsloader investigations.
Register here 👉 https://t.co/A4UBrPZOW4
🇮🇹 Riprendono le attività delle campagne #MintsLoader
⚠️ Dopo una lunga pausa estiva, nella giornata di ieri è stata osservata una nuova campagna #MintsLoader via #PEC, la prima dopo quella registrata lo scorso giugno.
ℹ️ Approfondimenti e #IoC 👇
🔗 https://t.co/T1RnYNGW32
➡️ Individuata una nuova campagna ita #MintsLoader tramite messaggi inviati da caselle #PEC compromesse
➡️ Rilevata una nuova campagna di smishing ai danni di #INPS, finalizzata alla sottrazione di dati e documenti personali
➡️ Continua phishing con nome e il logo di #PagoPA
🧀 Update on MintsLoader: a thread 🔽
MintsLoader is a JavaScript/PowerShell loader that was first detailed by OCD in 2024.
A new version has been around at least since early-June 2025.
#cti #ThreatIntel #mintsloader
#ThreatProtection #MintsLoader #Malware #Campaign hits Italian PEC users with Calendar-aware tactics. Read more about Symantec's protection: https://t.co/M1TGeqfwuV #Cybercrime #Cybersecurity
🇮🇹 Nuova campagna #MintsLoader conferma una mirata strategia temporale
🔎 Colpire esclusivamente nelle giornate feriali, quando gli utenti sono più inclini a consultare le email lavorative, specialmente se a seguito di una pausa.
🔗 https://t.co/wIJYzmBTDs
#MintsLoader > #PEC #Italy
👇
brettesxes.]com/1.php?s=flibabc12
abckdkfkgdjnkhe.]top/zeqvk8x13ghtr.php
Samples👇 @luc4m
https://t.co/cpKeZi6M77
#MintsLoader #Spain
geronimo.]website/1.php?s=flibabc12
glmhhdcmgcfddbk.]top/upow4fi5hvhtr.php
❇️Summary
https://t.co/qMgrhHRIoF
![JAMESWT_WT's tweet photo. #MintsLoader > #PEC #Italy
👇
brettesxes.]com/1.php?s=flibabc12
abckdkfkgdjnkhe.]top/zeqvk8x13ghtr.php
Samples👇 @luc4m
https://t.co/cpKeZi6M77
#MintsLoader #Spain
geronimo.]website/1.php?s=flibabc12
glmhhdcmgcfddbk.]top/upow4fi5hvhtr.php
❇️Summary
https://t.co/qMgrhHRIoF https://t.co/RsjlCW8hNQ](https://pbs.twimg.com/media/GsllgJRW0AAg8_G.jpg)
![JAMESWT_WT's tweet photo. #MintsLoader > #PEC #Italy
👇
brettesxes.]com/1.php?s=flibabc12
abckdkfkgdjnkhe.]top/zeqvk8x13ghtr.php
Samples👇 @luc4m
https://t.co/cpKeZi6M77
#MintsLoader #Spain
geronimo.]website/1.php?s=flibabc12
glmhhdcmgcfddbk.]top/upow4fi5hvhtr.php
❇️Summary
https://t.co/qMgrhHRIoF https://t.co/RsjlCW8hNQ](https://pbs.twimg.com/media/GsllfN8XcAAig9_.jpg)
![JAMESWT_WT's tweet photo. #MintsLoader > #PEC #Italy
👇
brettesxes.]com/1.php?s=flibabc12
abckdkfkgdjnkhe.]top/zeqvk8x13ghtr.php
Samples👇 @luc4m
https://t.co/cpKeZi6M77
#MintsLoader #Spain
geronimo.]website/1.php?s=flibabc12
glmhhdcmgcfddbk.]top/upow4fi5hvhtr.php
❇️Summary
https://t.co/qMgrhHRIoF https://t.co/RsjlCW8hNQ](https://pbs.twimg.com/media/Gslld0dW0AEQGmc.jpg)
Related
"#MintsLoader: #StealC and BOINC"
samples covered
👇
https://t.co/GG6dzeIjzA
extra
https://t.co/l8md83HDom
Boinc
https://t.co/tHyXENX3UM
Some #MintsLoader + "temp" url in common
11/2024
4c45dcb97fd466caca3ad9a556b2367148fe497b3055bddd378876272f2ad957
01/2025
https://t.co/3g8KDuiPzY
04/2025
3B84447288C2F0D93F40EB745E1126DC947D0DEFBDBE1BF1D62BFAD5B67031E4
Some #MintsLoader + "temp" url in common
11/2024
4c45dcb97fd466caca3ad9a556b2367148fe497b3055bddd378876272f2ad957
01/2025
https://t.co/3g8KDuiPzY
04/2025
3B84447288C2F0D93F40EB745E1126DC947D0DEFBDBE1BF1D62BFAD5B67031E4
Mentioned #MintsLoader via #Italy #PEC Samples
👇
https://t.co/IwmUfYAu4p
⛔️C2
lknafbafiiclfgl[.]top
sdfjkhgyu6wjkhlasyhd[.]op
![JAMESWT_WT's tweet photo. Mentioned #MintsLoader via #Italy #PEC Samples
👇
https://t.co/IwmUfYAu4p
⛔️C2
lknafbafiiclfgl[.]top
sdfjkhgyu6wjkhlasyhd[.]op https://t.co/92dJvRcLGc](https://pbs.twimg.com/media/GqU9ifaW4AAhsnj.jpg)
🇮🇹 Nuova campagna #MintsLoader diffonde il malware #Stealc attraverso caselle #PEC compromesse
🎯 #Stealc infostealer (MaaS)
➡️ browser
➡️ estensioni
➡️ wallet di criptovalute
➡️ client email
➡️ altre applicazioni
ℹ️ Approfondimenti e #IoC 👇
🔗 https://t.co/uIgqdH1wwy
🇮🇹 Nuova campagna #MintsLoader diffonde il malware #Stealc attraverso caselle #PEC compromesse
🎯 #Stealc infostealer (MaaS)
➡️ browser
➡️ estensioni
➡️ wallet di criptovalute
➡️ client email
➡️ altre applicazioni
ℹ️ Approfondimenti e #IoC 👇
🔗 https://t.co/uIgqdH1wwy
Experts shared up-to-date C2 domains and other artifacts related to recent #MintsLoader Attacks
https://t.co/ATHxh5bn7g
#securityaffairs #hacking #malware
@TheRecord_Media
#MintsLoader Drops #GhostWeaver via Phishing, ClickFix — Uses DGA, TLS for Stealth Attacks
https://t.co/FHwDQATQ3W
#ThreatProtection #MintsLoader fuels stealthy attacks with AntiVM tactics, obfuscated scripts and rotating C2 domains. Read more about Symantec's protection: https://t.co/kTnwE6LTjt #Malware
🇮🇹 Nuova ondata malevola via #PEC: MintsLoader ora distribuisce #AsyncRat
✉️ Comunicazione di sollecito per il pagamento [Ragione Sociale]
⚔️ TTP: JS + PS1 #MintsLoader
ℹ️ Approfondimenti e #IoC 👇
🔗 https://t.co/HDILc1mraK
![AgidCert's tweet photo. 🇮🇹 Nuova ondata malevola via #PEC: MintsLoader ora distribuisce #AsyncRat
✉️ Comunicazione di sollecito per il pagamento [Ragione Sociale]
⚔️ TTP: JS + PS1 #MintsLoader
ℹ️ Approfondimenti e #IoC 👇
🔗 https://t.co/HDILc1mraK https://t.co/yMbryZlFjH](https://pbs.twimg.com/media/Gm5UAs6XwAA9bYw.jpg)
Deobfuscated second stage #MintsLoader used in malspam campaign
📦S1:
p://<DGA_DOMAIN>.top/1.php?s=flibabc11
📦S2:
p://<DGA_DOMAIN>.top/<RANDOM_CHAR>htr.php?id=<VICTIM_HOSTNAME>&key=<FLAG_ID>&s=flibabc11
🧐High similarity:
https://t.co/3g8KDujnpw
🍬 Daily dose of #MintsLoader C2s, registered yesterday:
dlghjjhdchbkjbd[.]top
sekawctenilfkgp[.]top
lbbkbinkemlhein[.]top
IOC farming time... 🐮
🍬 Potentially newly registered #MintsLoader domains:
bgllakndcidgcnj[.]top
daedfjkgnikkbkb[.]top
gnbmanbacedkgaj[.]top
nuuhhcfenjoywca[.]top
🌎 New web inject URL (#UNC4108):
query-js-ajax[.]com
👻 #GhostWeaver C2:
wu2qmpa2vndlnhb[.]top
Daily dose of potential #MintsLoader domains registered yesterday:
kdljlignmgemecf[.]top
usdgyzjey4h[.]top
mioasfybz7y4[.]top
nfuagy7fgus[.]top
l284afj165tqz51[.]top
icciilhkbdgjggn[.]top
anccvfsrkauefoh[.]top
Last Seen Hashtags on Sotwe
Most Popular Users
Elon Musk 
@elonmusk
240.8M followers
Barack Obama
@barackobama
119.2M followers
Donald J. Trump
@realdonaldtrump
111.7M followers
Cristiano Ronaldo
@cristiano
111M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
97.8M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91M followers
KATY PERRY
@katyperry
87.9M followers
Taylor Swift
@taylorswift13
81.7M followers
Lady Gaga
@ladygaga
73.3M followers
Virat Kohli
@imvkohli
70.3M followers
Kim Kardashian
@kimkardashian
69.9M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64M followers
Neymar Jr
@neymarjr
63.1M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.9M followers
Selena Gomez
@selenagomez
61M followers
X
@x
60.8M followers