Indicators of Compromise

Filename

TLP:CLEAR

rmsw.bat

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

ADAC.io

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

iDox.ai

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

elife-93050-supp1.pdf

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

elife-93050-mdarchecklist1.docx

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Decryption.txt

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

runtimes.exe

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

gpscript.exe

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

adm.exe

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

Gpscript.exe

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Test.txt

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

runas.exe

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

update.bat

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

XBCUninstaller.exe

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

WinMainSvc.dll

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

termsrv.dll

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

https://get-analytics-repository.s3.ap-southeast-1.amazonaws.com/a4p8cg?em=redacted@abuse.ionos.com

PhishTank: https://get-analytics-repository.s3.ap-southeast-1.amazonaws.com/a4p8cg?em=redacted@abuse.ionos.com

90% confidence

Added

2026-08-08

URL

TLP:CLEAR

https://mosnerv.ru/wp-admin/user/#redacted@abuse.ionos.com

PhishTank: https://mosnerv.ru/wp-admin/user/#redacted@abuse.ionos.com

90% confidence

Added

2026-08-08

URL

TLP:CLEAR

https://enhanced-studio-endpoint-td1.s3.us-west-2.amazonaws.com/k2CPQ6h1?em=redacted@abuse.ionos.com

PhishTank: https://enhanced-studio-endpoint-td1.s3.us-west-2.amazonaws.com/k2CPQ6h1?em=redacted@abuse.ionos.com

90% confidence

Added

2026-08-08

URL

TLP:CLEAR

https://bgmforklift.com/i/?c3Y9Z2VuZXJhbCZyPVJTJnVpZD1VU0VSMDQwMTIwMjZVMjEwMTA0MDImcz1tZw==redacted@abuse.ionos.com

PhishTank: https://bgmforklift.com/i/?c3Y9Z2VuZXJhbCZyPVJTJnVpZD1VU0VSMDQwMTIwMjZVMjEwMTA0MDImcz1tZw==redacted@...

90% confidence

Added

2026-08-08

URL

TLP:CLEAR

https://media-510.s3.us-west-1.amazonaws.com/9r6alIxZOpNnU?em=redacted@abuse.ionos.com

PhishTank: https://media-510.s3.us-west-1.amazonaws.com/9r6alIxZOpNnU?em=redacted@abuse.ionos.com

90% confidence

Added

2026-08-08

URL

TLP:CLEAR

https://mosnerv.ru/wp-admin/js/#redacted@abuse.ionos.com

PhishTank: https://mosnerv.ru/wp-admin/js/#redacted@abuse.ionos.com

90% confidence

Added

2026-08-08

URL

TLP:CLEAR

https://www.kapoorautomobile.in/#redacted@abuse.ionos.com

PhishTank: https://www.kapoorautomobile.in/#redacted@abuse.ionos.com

90% confidence

Added

2026-08-08

Domain

TLP:CLEAR

startpasskeysetup.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

ssopasskey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

sqfepjvmrd.xyz

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

secure-passkey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkeystatus.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkeyrollout.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkeymfa.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkeycreator.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkeyenable.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkeyactivation.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkey-connect.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkey-enable.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

passkey-check.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

oskeyconnect.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

newpasskey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

myssopasskey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

mypasskeyid.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

mspasskey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

myaccountsecurity.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

makepasskey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

hubpasskey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

enrollpasskey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

enablepasskey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

createmfa.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

checkpasskey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

addyourpasskey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07

Domain

TLP:CLEAR

addssopasskey.com

Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments

75% confidence

Added

2026-08-07