ctrlINT What the industry said about every indicator, with the quote

obfuscator[.]ioDomain

Reported by 4 independent sources · first reported by Sekoia.io · last reported

Last reported 1 month ago

What the reports say

6 reports, newest first · the exact sentence from each
  1. “Layer 1:  obfuscator[.]io string-array shuffle.”

    Group-IBVendor
    Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit
  2. “… to change the signature of the code and used different random strings for variable and function names, consistent with output from “Obfuscator[.]io” and similar Javascript obfuscation tools.”

    Cisco TalosVendor
    ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
  3. “The Javascript file check.js is an input-validation and auto-formatting utility partially obfuscated using obfuscator[.]io.”

    Group-IBVendor
    The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action
  4. “…afted masterpiece of JavaScript weirdness and more likely to meet output from tools like the npm package “javascript-obfuscator” or “obfuscator[.]io”.”

    Cisco TalosVendor
    JavaScript obfuscation: From party trick to phishing kit
  5. “How obfuscator[.]io hides the malware's code”

    Elastic Security LabsVendor
    New North Korean campaign uses fake coding interviews to steal developer credentials
  6. “…it was the case with lekolin.org and ciwanensoresger.com, while others are contained in a single JavaScript file and obfuscated with Obfuscator[.]io, as seen with nuceciwan129.xyz.”

    Sekoia.ioVendor
    SilentSelfie: Major Campaign Against Kurdish Websites

Indicators reported together

named in the same reports
Copy these 19 indicators · defanged

Thanks — we review every report.

Report a wrong value
What is wrong with obfuscator[.]io here?
No account needed. We do not store your IP address.