ctrlINT What the industry said about every indicator, with the quote

cdnzona.discloud[.]appDomain

Reported by 1 independent source · first reported by The Hacker News · last reported

Last reported 17 days ago

What the reports say

1 report, newest first · the exact sentence from each

  1. “"That font value triggers a hidden routine that downloads node.exe from cdnzona.discloud[.]app, a host on a Brazilian application hosting service, saves it to %APPDATA%\node.exe, and runs it with its window hidden."”

    The Hacker NewsNews
    Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

Indicators reported together

named in the same reports

Also named with it: CVE-2026-60137, CVE-2026-63030

Thanks — we review every report.

Report a wrong value
What is wrong with cdnzona.discloud[.]app here?
No account needed. We do not store your IP address.