LabHostThreat actor
LabHost is a threat actor group targeting Canadian Banks with Phishing-as-a-Service attacks. They have been observed using tools like LabRat and LabSend for real-time campaign management and SMS lures. LabHost's phishing campaigns have similarities to Frappo campaigns, but they operate separately and offer different subscription packages.From MISP Galaxy
Last reported 2 years ago, by Group-IB1 report
What the reports say
1 report, newest first · the exact sentence from each-
Phishy Business: Unraveling LabHost’s scam ecosystem“Phishy Business: Unraveling LabHost’s scam ecosystem”
Indicators in its reports
named in the reports above- 188.114.96[.]1in 1 report
- scamadviser[.]comin 1 report
- lab-host[.]ruin 1 report
- hxxps://instapi-1xoa93z90o348fz[.]co/file-xm3728d/1709912030/global-dhl.zipin 1 report
- instapi-1xoa93z90o348fz[.]coin 1 report
- hxxps://api2-4hdfix74ks[.]co/#in 1 report
- api2-4hdfix74ks[.]coin 1 report
- fe6b5bee1c6a8bcd5465abebf0f78c94in 1 report
- 35634d6ddec658ad…aed667fcd244in 1 report
- 357313ec1a0b5318…fc194d9d52cfin 1 report
- 465a469e1d02522c7f23269f6f5d6daein 1 report
- 4863dcaa3b624b27fcd49b1263e90d9cin 1 report
- 3cfd406909d4684e1416d67e8158afc5in 1 report
- hxxps://t[.]me/MrSmartICQin 1 report
- hxxps://t[.]me/houdini13in 1 report
- hxxps://t[.]me/labhostin 1 report
- hxxps://labhost[.]ccin 1 report
- labhost[.]ccin 1 report
- hxxps://t[.]me/Zimna514in 1 report
- hxxps://labhost[.]coin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.