Indicators of Compromise

Domain

TLP:CLEAR

Domainaab.sportsontheweb.netStage

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

http://aab.sportsontheweb.net/x.phpBeacon

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Filenamepayload.binDropped

50% confidence

Added

2026-08-09

Email Address

TLP:CLEAR

Emaila39155771@gmail.comMaintainer

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

bun.exe

50% confidence

Added

2026-08-09

Email Address

TLP:CLEAR

a39155771@gmail.comEmailMaintainer

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

aab.sportsontheweb.netDomainStage

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

http://aab.sportsontheweb.net/x.phpURLBeacon

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

256preinstall.js

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

256setup.mjs

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

256payload.gz

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

payload.binFilenameDropped

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

MBSetup.exe

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

sportsontheweb.net

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

oob.moika.tech

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

package-lock.json

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

yarn.lock

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

pnpm-lock.yaml

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

npm.cmd

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

npm.exe

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

npx.cmd

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

npx.exe

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Sicoob.Sdk

50% confidence

Added

2026-08-09

Email Address

TLP:CLEAR

a39155771@gmail.com

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

preinstall.js

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

npm.js

50% confidence

Added

2026-08-09

SHA-256 Hash

TLP:CLEAR

638788afc4f1b5860a328312caf5895abd5f5632d28a4f2a85b09076e270d15d

Typosquatted npm packages used to steal cloud and CI/CD secrets

75% confidence

Added

2026-05-29

MD5 Hash

TLP:CLEAR

106bc56415ee087c8a432b2f0f90aa2d

Typosquatted npm packages used to steal cloud and CI/CD secrets

75% confidence

Added

2026-05-29

SHA-1 Hash

TLP:CLEAR

ddd329f1e009abbab39199d6362d2b340c96e41a

Typosquatted npm packages used to steal cloud and CI/CD secrets

75% confidence

Added

2026-05-29

SHA-256 Hash

TLP:CLEAR

77d92efe7af3547f71fd41d4a884872d66b1be9499eaa637e91eac866911694d

Typosquatted npm packages used to steal cloud and CI/CD secrets

75% confidence

Added

2026-05-29

SHA-256 Hash

TLP:CLEAR

bfa149694ec6411c23936311a999163ade54d6f38e2f4b0e3cfb8cb67bd7cfaa

Typosquatted npm packages used to steal cloud and CI/CD secrets

75% confidence

Added

2026-05-29

URL

TLP:CLEAR

http://aab.sportsontheweb.net/x.php

Typosquatted npm packages used to steal cloud and CI/CD secrets

75% confidence

Added

2026-05-29

Domain

TLP:CLEAR

aab.sportsontheweb.net

Typosquatted npm packages used to steal cloud and CI/CD secrets

75% confidence

Added

2026-05-29