apistructsaction[.]javaDomain
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 15 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge“…6-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction[.]java" component.”
-
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer“CVE-2026-105133: A medium-severity flaw affecting the checkSysPwd function of the file com/ahsay/obs/api/ApiStructsAction[.]java, which can lead to improper authentication.”
Indicators reported together
named in the same reports- 177.4.12[.]11in 1 report
- updatereceivers[.]doin 1 report
- 51.195.127[.]124in 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/Taskgmr.ps1in 1 report
- 38.60.252[.]110in 1 report
- 107.191.47[.]199in 1 report
- 185.220.236[.]49in 1 report
- 104.234.26[.]10in 1 report
- 123.202.208[.]37in 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/edge.exein 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/msedge.exein 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/config.jsonin 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/WinRing0x64.sysin 1 report
- 05f69ae6b2b89c1c…045d06139034in 1 report
- 4dcb0202fe8b2d4d…f4bce1dd6f3din 1 report
- 481728a7c9c4c02b…4818e3d25d21in 1 report
Copy these 16 indicators · defanged
Also named with it: CVE-2026-105133, CVE-2026-105134
Thanks — we review every report.