ehegisnightmare[.]icuDomain
Reported by 2 independent sources · first reported by Elastic Security Labs · last reported
Last reported 5 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic“…th-chromium.com/APIService") to fetch a second PowerShell script ("drop.ps1") that downloads an executable ("bludness.exe") from "ehegisnightmare[.]icu" and launches it in a hidden window.”
-
Auditing the auditor: Unmasking Apex Accelerator“The response is a PowerShell script named drop.ps1, which downloads an executable from hxxps://ehegisnightmare[.]icu/build/nTOugj-fWWMurYHg/bludness.exe and launches it in a hidden window:”
Indicators reported together
named in the same reports- vrf.apexaccs[.]orgin 2 reports
- verify.apexfdn[.]xyzin 2 reports
- ccmihr[.]comin 2 reports
- 0auth-chromium[.]comin 2 reports
- apexaccs[.]orgin 2 reports
- hxxps://vrf.apexaccs[.]org/api/v1/vrfin 1 report
- hxxps://verify.apexfdn[.]xyz/macos/installer/terminal/interactive/bashin 1 report
- hxxps://arena.apexaccs[.]org/dashboard/pilotin 1 report
- arena.apexaccs[.]orgin 1 report
- hxxps://arena.apexaccs[.]org/api/llm/v1in 1 report
- hxxps://arena.apexaccs[.]org/api/llm/v1/chat/completionsin 1 report
- hxxps://arena.apexaccs[.]org/api/copilot/mcpin 1 report
- arenapex[.]cloudin 1 report
- cloudmain365duo[.]topin 1 report
- fdn4apex[.]comin 1 report
- hxxps://main.router-apex[.]com/updater.shin 1 report
- main.router-apex[.]comin 1 report
- hxxps://update.apex-arena-router[.]com/loader.shin 1 report
- update.apex-arena-router[.]comin 1 report
- d719bf57e65ba09d…ad221adb8151in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.