Indicators of Compromise

Filename

TLP:CLEAR

Winword.exe

50% confidence

Added

2026-08-12

Domain

TLP:CLEAR

prozenith-pinksalt.com

ThreatFox: ClearFake

85% confidence

Added

2026-08-09

Domain

TLP:CLEAR

dmrhew.prozenith-pinksalt.com

ThreatFox: ClearFake

85% confidence

Added

2026-08-09

Domain

TLP:CLEAR

pinksalt-prozenith.com

ThreatFox: ClearFake

85% confidence

Added

2026-08-09

Domain

TLP:CLEAR

hhypswg.pinksalt-prozenith.com

ThreatFox: ClearFake

85% confidence

Added

2026-08-09

Domain

TLP:CLEAR

pink-salt.us

ThreatFox: ClearFake

85% confidence

Added

2026-08-09

Domain

TLP:CLEAR

rvpsviz.pink-salt.us

ThreatFox: ClearFake

85% confidence

Added

2026-08-09

Domain

TLP:CLEAR

vtptolt.pink-salt.us

ThreatFox: ClearFake

85% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Shortcut.IconLocation

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

xxx.zip

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Shortcut.Arguments

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Shortcut.TargetPath

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

WshShell.CreateShortcut

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

dism.exe

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

TextBin.net

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

http://raw.githubusercontent.com/peterlyly/zxcv/main/ccc.gif

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

176.10.80.38

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

form.Headers.ContentType.ToString

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

ms.ToArray

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

form.CopyToAsync

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

System.IO.MemoryStream

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

ascii.getbytes

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Darkpick.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

System.Net.Http.StringContent

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Net.ServicePointManager

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

System.Net.Http

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

System.Net.Http.MultipartFormDataContent

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

form.Add

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

System.IO.File

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

System.Net.Http.ByteArrayContent

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Content.Length

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

byte.Headers.Add

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

ascii.getstring

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

Dism.sys

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

System.Convert

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

System.Text.Encoding

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

Dism.exe

50% confidence

Added

2026-08-09

Email Address

TLP:CLEAR

blackpink.301@outlook.com

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

system.bat

50% confidence

Added

2026-08-09

Email Address

TLP:CLEAR

blackred.113@outlook.com

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

https://swingforepink.com/

PhishTank: https://swingforepink.com/

90% confidence

Added

2026-08-07

Domain

TLP:CLEAR

startpasskeysetup.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

ssopasskey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

sqfepjvmrd.xyz

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

secure-passkey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkeystatus.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkeyrollout.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkeymfa.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkeyenable.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkeycreator.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07