easyllms[.]xyzDomain
Reported by 1 independent source · first reported by The Hacker News · last reported
Last reported 9 days ago
What the reports say
1 report, newest first · the exact sentence from each-
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More“… x64 stager that fingerprints the host computer name, logged-on user, processor configuration, and installed memory, then connects to easyllms[.]xyz over HTTPS and retrieves a file named payload.bin from a path guarded by a long hexadecimal identifier, disabling TLS certificate val…”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-0257, CVE-2026-79610, CVE-2026-108065, CVE-2026-110392, CVE-2026-47595, CVE-2026-106931, CVE-2026-101341, CVE-2026-101339, CVE-2026-101338, CVE-2026-101337
Thanks — we review every report.