NaxoziwuS

Cybersecurity & AI security • threat intelligence & hunting
Exploring AI agents, autonomous security, and AI-powered defense.

[NaxoziwuS @naxoziwus]

🔍 ClearFake / ClickFix Infrastructure Telemetry & Deobfuscation Analysis

[Deobfuscation & Analysis Mechanism]:
• Script Obfuscation: Injected loader executes in-line multi-stage decoding via String.fromCharCode(char ^ k1) -> window.atob() -> String.fromCharCode(byte ^ k2).
• Smart Contract Resolution: Decentralized C2 resolution performed via Ethereum JSON-RPC eth_call targeting Polygon Mainnet.
• Dynamic TDS Hooking: Headless Chrome DOM analysis captures dynamically injected /api.php?s=<hex_session_key> script tags.

[Blockchain & Secondary C2 Infrastructure]:
• Polygon Smart Contract: 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2
• Contract Method Hash: 0xb68d1809
• Resolved Active On-Chain C2: hxxps://entry-verifed-cdn[.]codes
• Active Parallel TDS Clusters:
- hxxps://makeverizyjar[.]info
- hxxps://cloudeccentric[.]cc
- hxxps://lovezramexar[.]info

[Payload Delivery & Execution Flow]:
• Initial Stage: HTML/DOM overlay presenting spoofed browser update / verification modals (ClickFix).
• Execution Method: Social engineering prompt directing users to paste clipboard contents into Windows PowerShell or macOS Terminal.
• Secondary Stage: PowerShell -enc / curl loader scripts downloading and executing infostealer families (Lumma, Stealc, AMOS).

[Identified Compromised Hosts]:
• a2mcconsult[.]com[.]br
• adepam91[.]fr
• annfragrances[.]com
• anpagroup[.]co[.]id
• anythingliquid[.]co[.]za
• lbcls[.]com
• mimoneuro[.]org
• www[.]ameliaciclopica[.]it
• www[.]appreciatedapp[.]com
• www[.]maxcredit[.]it

#ThreatIntel #ClearFake #ClickFix #EtherHiding #CyberSecurity #SOC #BlueTeam #Malware #InfoSec #CyberDefense

[NaxoziwuS @naxoziwus]

🔍 ClearFake / ClickFix Infrastructure Telemetry & Deobfuscation Analysis

[Deobfuscation & Analysis Mechanism]:
• Script Obfuscation: Injected loader executes in-line multi-stage decoding via String.fromCharCode(char ^ k1) -> window.atob() -> String.fromCharCode(byte ^ k2).
• Smart Contract Resolution: Decentralized C2 resolution performed via Ethereum JSON-RPC eth_call targeting Polygon Mainnet.
• Dynamic TDS Hooking: Headless Chrome DOM analysis captures dynamically injected /api.php?s=<hex_session_key> script tags.

[Blockchain & Secondary C2 Infrastructure]:
• Polygon Smart Contract: 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2
• Contract Method Hash: 0xb68d1809
• Resolved Active On-Chain C2: hxxps://entry-verifed-cdn[.]codes
• Active Parallel TDS Clusters:
- hxxps://makeverizyjar[.]info
- hxxps://cloudeccentric[.]cc
- hxxps://lovezramexar[.]info

[Payload Delivery & Execution Flow]:
• Initial Stage: HTML/DOM overlay presenting spoofed browser update / verification modals (ClickFix).
• Execution Method: Social engineering prompt directing users to paste clipboard contents into Windows PowerShell or macOS Terminal.
• Secondary Stage: PowerShell -enc / curl loader scripts downloading and executing infostealer families (Lumma, Stealc, AMOS).

[Identified Compromised Hosts]:
• 173[.]231[.]196[.]249
• 198[.]199[.]84[.]181
• 210[.]245[.]90[.]206
• 31[.]147[.]204[.]35
• 35[.]154[.]224[.]78
• 44384f75[.]roxymigurdia[.]wiki
• 45[.]79[.]202[.]83
• 45[.]8[.]93[.]168
• 5[.]63[.]157[.]201
• 51[.]79[.]204[.]217
• 52[.]21[.]159[.]183
• 52[.]23[.]9[.]8
• 52[.]76[.]43[.]213
• 54[.]173[.]170[.]130
• 54[.]197[.]245[.]249
• 54[.]39[.]68[.]142
• 54[.]76[.]13[.]162
• 62[.]133[.]62[.]176
• 62[.]169[.]23[.]56
• 64[.]227[.]129[.]58
• 65[.]49[.]82[.]3
• 66[.]39[.]79[.]68
• 69[.]164[.]207[.]137
• 69[.]57[.]163[.]151
• 72[.]167[.]134[.]175
• 74[.]48[.]108[.]236
• 74[.]48[.]114[.]55
• 74[.]50[.]99[.]45
• 77[.]237[.]247[.]182
• 77[.]246[.]147[.]92
• 78[.]46[.]240[.]128
• 80[.]71[.]229[.]25
• angelsnpact[.]org
• aulavirtual[.]morelia[.]tecnm[.]mx
• bapak178[.]org
• breakneckridgefarm[.]com
• carmaxautodetailing[.]com
• cestmonterrey[.]edu[.]mx
• daleeby[.]com
• deckweapons[.]com
• diamondqualitycontractors[.]com
• divinesoulcamp[.]com
• dualsurvey[.]com
• duomegahair[.]com[.]br
• frameworkservice[.]online
• hahah1101[.]mom
• horkyboty[.]cz
• ieclearbra[.]com
• imaziner[.]com
• innov8league[.]com
• instantsport[.]info
• intrastructure[.]co
• invoiceguru[.]co[.]za
• kayndrexsphere[.]net
• lospls[.]com
• lunar-arc-birch-caum[.]icu
• maccloudvault[.]com
• macflame[.]com
• metropolio[.]pl
• nathialcorporation[.]com
• newagglomerationsystem[.]pl
• nguoidoncui[.]xyz
• nimzara[.]com
• pantherchile[.]com
• prudenceflores[.]com
• psychogeographie[.]org
• resolvend[.]com
• semarketingsymposium[.]com
• share[.]dovgertz[.]com
• sportorium[.]ptumb[.]com
• thebogles[.]com
• thewhitehouse-notl[.]com
• wepoc[.]co
• win88[.]co[.]id
• www[.]adapadske[.]org
• www[.]altaleghje[.]com
• www[.]denteste[.]com
• www[.]fitnessstudiopk[.]com
• www[.]mecater[.]com
• www[.]milanbike[.]it
• www[.]pomitni[.]com
• www[.]reseaucupidontogo[.]org
• www[.]rideaux-metalliques-strasbourg[.]com
• www[.]sensasian-concept[.]com
• www[.]skillseekers[.]ca
• www[.]themedslots[.]com
• www[.]thewidowerskitchen[.]com
• www[.]tongheshop[.]com
• www[.]tosuninsaat[.]com[.]tr

#ThreatIntel #ClearFake #ClickFix #EtherHiding #CyberSecurity #SOC #BlueTeam #Malware #InfoSec #CyberDefense

[Furkan @tweetozof]

👀 ClearFake / ClickFix (Smart Contract C2) — Massive Global Wave 🌊

Over 45+ newly compromised hosts detected across the world serving the exact same ClearFake cluster.

[Newly Compromised Injected Hosts (Complete Wave)]
• vc[.]sa
• visaphanlan[.]com
• webkinn[.]com
• websitedesigncharlotte[.]com
• websolutions[.]lt
• weslinc[.]com
• whatsoninreddeer[.]com
• whominds[.]com
• wicked-tuff[.]com
• widyamanggala[.]ac[.]id
• wienflower[.]at
• wiltonstamebudgies[.]com
• withartemis[.]net
• wordpress-zakelijk[.]strijbosch[.]nl
• wordpress[.]maartendevoldere[.]be
• wordpress[.]soulapp[.]me
• work-skills-global[.]com
• work-source[.]app
• wowwatch[.]nl
• wtadelden[.]nl
• www[.]wendyvonsosen[.]com
• www[.]wildsoulssalonstudios[.]com
• www[.]wntt[.]zone
• www[.]xn--shipo-esa[.]com
• xaynhatrongoitphcm[.]vn
• xn----3mci2aha3gqbzb[.]com
• xn--frulein-frost-cfb[.]de
• xn--ih3bm3h02eowa8w[.]com
• xxl-schlemmerhaus[.]de
• yalabigcatsafari[.]com
• yeet[.]company
• yelloweasel[.]com
• yellowtreecs[.]com
• yogacoucou[.]com
• yourbodyisyourbestfriend[.]com
• z-creations[.]com
• zabava-artes[.]cz
• zalphabet[.]com
• zapalocho[.]com
• zeaslazanky[.]cz
• zendogzz[.]com
• zesanenterprises[.]com
• zim-h2[.]com
• zocity[.]nl
• zucchinicru[.]com

[Injected Script Obfuscation Layer]
• In-line Double-XOR + Base64 JavaScript Loader
• Obfuscated arrays dynamically decoded via fromCharCode & charCodeAt

[Decentralized Blockchain C2 Infrastructure (Polygon MATIC)]
• Smart Contract: 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2
• Method Hash: 0xb68d1809
• Public RPC Nodes: polygon-bor-rpc.publicnode[.]com | 1rpc[.]io/matic

[Resolved Live C2 / TDS Infrastructure]
• hxxps://idcool[.]codes

[Observed TDS / Staging Delivery URLs]
• hxxps://idcool[.]codes/api.php?s=a3946e3ded820e3d2f02885bf63c8a3a176d58bb9403b402

Full IOC list, daily CSVs, and continuous tracking:
https://t.co/2L0ivtRmQs

#ClickFix #ClearFake #ThreatIntel #Malware #CyberSecurity #IOC #Infostealer

[Furkan @tweetozof]

👀 ClearFake / ClickFix (Smart Contract C2) — Observed IOCs

[Compromised Injected Hosts (Initial Access)]

ucc-tr[.]com (IP: 160.153.0[.]62)
uberrichinfatcity[.]com (IP: 159.203.141[.]19)
unicarsistem[.]com
https://t.co/c2uL8P8k71[.]ni
unitedmovingusa[.]com

[Injected Script Obfuscation Layer]

In-line Double-XOR + Base64 JavaScript Loader
XOR Key 1: 78
XOR Key 2: 95
Function: Queries decentralized blockchain RPC to fetch active C2

[Decentralized Blockchain C2 Infrastructure (Polygon MATIC)]

Network: Polygon Mainnet
Smart Contract: 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2
Method Hash: 0xb68d1809
Public RPC Nodes Used:hxxps://polygon-bor-rpc.publicnode[.]com
hxxps://1rpc[.]io/matic
hxxps://polygon.drpc[.]org
hxxps://rpc.ankr[.]com/polygon

[Resolved Live C2 / TDS Infrastructure]
idcool[.]codes
[Observed TDS / Staging Delivery URLs]
hxxps://idcool[.]codes/api.php?s=8402fb1338daab6a166e91aa8c92a20798acfa98fb75c5a2

[Furkan @tweetozof]

👀 NEW | ClearFake / ClickFix (Smart Contract C2) - Observed IOCs

[Compromised Injected Hosts (Initial Access)]

• ubgeneraltrading[.]com (IP: 162.241.216[.]86)
• unitedpowerprojects[.]com (IP: 82.25.127[.]247)
• unitedtransport[.]co[.]in (IP: 2a02:4780:11:1427:0:236d:9f44:10)
• www[.]vault55[.]com (IP: 69.163.179[.]165)
• vbbs[.]edu[.]vn (IP: 103.90.233[.]81)

[Injected Script Obfuscation Layer]
• In-line Double-XOR + Base64 JavaScript Loader
• Technique: fromCharCode(arr[i] ^ k1) -> atob() -> charCodeAt() ^ k2
• Function: Executes decentralized JSON-RPC query to fetch live C2

[Decentralized Blockchain C2 Infrastructure (Polygon MATIC)]
• Smart Contract: 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2
• Method Hash: 0xb68d1809
• Public RPC: polygon-bor-rpc.publicnode[.]com | 1rpc[.]io/matic

[Resolved Live C2 / TDS Infrastructure]
• hxxps://idcool[.]codes

[Observed TDS / Staging Delivery URLs]
• hxxps://idcool[.]codes/api.php?s=a3946e3ded820e3d2f02885bf63c8a3a176d58bb9403b402

#ClickFix #ClearFake #ThreatIntel #Malware #CyberSecurity #IOC

[Furkan @tweetozof]

👀 macOS ClickFix / Infostealer — Observed IOCs

[Ad / Affiliate Redirect Chain]
659191.toplakehorizon[.]com
verbestoffers[.]online
offerclickbid[.]space
byplaysnickieastr[.]com

[ClickFix Landing Infrastructure]
filecobaltgate[.]com
fileonyxzone[.]com

[Observed Landing URLs]
hxxps://filecobaltgate[.]com/cc3/?c=AOZTpWqWgwUAvYwCAFRSOQASAAAAAAAN
hxxps://fileonyxzone[.]com/oo1/?c=AHGNpmqYfwUAo4wCAFRSOQASAAAAAAAj

[Payload Delivery Infrastructure]
forgewillow[.]com

[Decoded Payload URLs]
hxxps://forgewillow[.]com/curl/poorol0tnce/y881nxsv96t09jy6n[.]dat
hxxps://forgewillow[.]com/curl/24wicq4yi/vdfgkvvsemos02nkka0r[.]txt

[Furkan @tweetozof]

A spectre is haunting the AI labs — the spectre of AGI.

@sama @DarioAmodei @elonmusk

[Furkan @tweetozof]

🦾

[Dragons Community 🪽 @DragonsCyberHQ]

👀 OWASP GenAI LLM Top 10 2026 is here.

The security landscape for AI applications is evolving fast — and the new list reflects it.

Key risks include:
• Prompt Injection
• Sensitive Information Disclosure
• Excessive Agency
• Supply Chain vulnerabilities
• Data & Model Poisoning
• Unbounded Consumption
• Misinformation
• Hidden Context Exposure
• Vector & Embedding Weaknesses
• Improper Output Handling

If you’re building or securing LLMs, AI Agents, RAG systems, or GenAI applications, this should be on your security checklist.

Full OWASP resource in the reply. 👇

#AIsecurity #OWASP #LLMSecurity #CyberSecurity

[Dragons Community 🪽 @DragonsCyberHQ]

Most developers spend weeks building AI apps, but never test if they’re actually secure.

That’s a mistake.

One of the most underrated open-source projects in AI security is Promptfoo.

It helps you evaluate, benchmark, and red-team LLM applications, AI agents, and RAG pipelines before they reach production.

With Promptfoo, you can:

🛡️ Detect prompt injection, jailbreaks, PII leaks, hallucinations, and tool misuse
📊 Compare GPT, Claude, Gemini, Llama, DeepSeek, and other models side by side
⚙️ Run automated LLM evaluations locally or as part of your CI/CD pipeline
📈 Benchmark prompts, models, AI agents, and RAG systems with reproducible metrics

The best AI engineers don’t just build prompts.

They test them like software.

⭐ GitHub: https://t.co/Is3xKuAb3G

If you’re building with LLMs, what’s your evaluation stack besides Promptfoo?

#AI #LLMSecurity #AIAgents #PromptEngineering

[NaxoziwuS @naxoziwus]

Found an interesting username during an investigation?

Search it across 2M+ threat actor usernames and instantly see where else it appears.

A simple but powerful OSINT tool.

👇
https://t.co/bshfBu614A

[NaxoziwuS @naxoziwus]

📡 Steam Workshop is no longer just for mods.

Attackers are hiding malware inside Wallpaper Engine wallpapers.

Some were downloaded thousands of times and used to hijack Steam sessions or infect users’ systems.

👇
https://t.co/i23Tel55BW

[NaxoziwuS @naxoziwus]

@tweetozof @NousResearch @Teknium the deeper you go, the harder it is to stop building 👀

[NaxoziwuS @naxoziwus]

🐀 BIGRAT - French RAT C2 Panel

IP: 147.93.55.87
rDNS: backup4.coinarchives[.]com

Analysis using @censysio

#ThreatIntel #C2 #BankingTrojan #InfoStealer #CyberSecurity #ThreatHunting

[NaxoziwuS @naxoziwus]

📡C2 Panel + Evilginx2 + Malware Staging

IP: 45.154.98.13

A multi-purpose attack server was observed on this host, combining phishing, C2, malware staging, and MaaS-style operator tooling.

Observed infrastructure / lures:

com-crypto[.]page
feat-done-fighters-appointed.trycloudflare[.]com

Suspicious binaries and loaders:

Agent7.exe — SHA256: 2156e71c208d68d1bcaa15374bc819b6d6d484eeb4816c929f990ffad9d4a1bd
svc_v2.exe — SHA256: f6a9541e3ea4439e5f1fa604787ba9c3d89d9988d3a779e2970b7e2537db47d3
winupdate.exe — SHA256: dffe0bd2ae1b3e9a3976098028ce4730bb4cc99266ae0ad9205c6df2dd958ce0
winmm_v14.dll — SHA256: 145d725efc40e35691764ac28e2c693c379a906a48298a4d9da8433a7ab59922
bootstrap.dll — SHA256: 48e14e086385990b9b33adf7e97a20056f2c6ec0197a78e6b78dbd19365aa036
version.dll — SHA256: 7736e41dd2a1a5b991d49dad2c88c177488344bd57b771d43f4c61574654bd89

Notable staging content exposed via open directory:

Q4_Financial_Report.iso
Q4_Financial_Report_2025.pdf.lnk
SilentLoader.cs
phishlets.json
hvnc.hex
extracted_combos.txt
panel-deploy.tar.gz
cloudflared.log
capsolver_log.txt

Malware delivery chain observed:

ISO/LNK-based execution
DLL side-loading via winmm.dll / version.dll
In-memory .NET assembly loading through Assembly.Load()
Cloudflare Tunnel retrieval of staged payloads
Fileless execution flow invoking AgentEntry. Run()

Open directory analysis indicates capabilities consistent with:
DLL side-loading implants
Fileless .NET stagers / downloaders
AMSI-evasion tradecraft
HVNC-enabled banking / account abuse tooling
Credential harvesting infrastructure
Large-scale combo storage
Crypto-themed phishing operations
Affiliate-style MaaS backend logic

Analysis using @censysio

@skocherhan
@JAMESWT_WT
@ViriBack

#ThreatIntel #C2 #Phishing #MaaS #Malware #ThreatHunting #CyberSecurity

[NaxoziwuS @naxoziwus]

📡 Blockchain-Auth Botnet C2 + Eternity DB

IP: 192.109.200.184

Associated phishing / operator infrastructure observed on this host:

sofiverify[.]live — SoFi impersonation
citi-verify00743[.]support — Citibank impersonation
7193usbankmemberauth[.]creditcard — U.S. Bank impersonation
americanexpressverify[.]support — American Express impersonation
0182-citizensmember-auth[.]creditcard — Citizens Bank impersonation
domaidbb1[.]loan — Generic loan / credit fraud theme

Operator management domains linked to the same infrastructure:
panel33.eas-x[.]com
vps2.eas-x[.]com
testtt.eas-x[.]com

Assessment:
Eternity DB may represent the data panel component of the Eternity Project ecosystem, while the Blockchain-Auth Botnet C2 appears tied to phishing operations targeting financial institutions.

Analysis using @censysio

#ThreatIntel #Phishing #C2 #Botnet #CyberSecurity #Malware #ThreatHunting

[NaxoziwuS @naxoziwus]

📡Ghost C2 + OpenClaw

IP: 91.99.7.144
Domain: roadmvn[.]com

Analysis using @censysio

#ThreatIntel #C2 #RAT #CyberSecurity #Malware #ThreatHunting

[NaxoziwuS @naxoziwus]

📡 Active Noctis C2

IP: 187.124.68.119
Domain: creanord[.]click

with @censysio

#ThreatIntel #C2 #RAT #CyberSecurity #Malware #ThreatHunting

[NaxoziwuS @naxoziwus]

📡 Chinese RAT C2 Panel found wide open on the internet

IP: 106.54.226.192

133 active victims.

Registry Run keys → Scheduled Tasks → Windows Services

UAC Bypass via fodhelper.exe &amp; eventvwr.exe

with @censysio

#ThreatIntel #C2 #RAT #CyberSecurity #Malware #ThreatHunting

[NaxoziwuS @naxoziwus]

PHANTOM C2

13.232.167.197

with @censysio

#ThreatIntel #C2 #PhantomC2 #ThreatHunting #InfoSec