worker[.]devDomain
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 5 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook“The REF3076 actors have leveraged the worker[.]dev Cloudflare Serverless infrastructure for C2 and file hosting.”
-
Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)“This is signal-based C2 migration: the HTTP 406 acts as a trigger from the operator indicating “the worker[.]dev domain is burned, and to switch to the backup”.”
Indicators reported together
named in the same reports- hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msiin 1 report
- hxxps://files.catbox[.]moe/tmp9fc.msiin 1 report
- hxxps://auth.qgtxtebl.workers[.]dev/in 1 report
- auth.qgtxtebl.workers[.]devin 1 report
- hxxps://github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msiin 1 report
- v2-api.mooo[.]comin 1 report
- 897eae49e6c32de3…c85cd538a189in 1 report
- 46831be6e577e312…90396393b751in 1 report
- hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/code.txtin 1 report
- 34b2a6c334813adb…b13bbd2381f4in 1 report
- bbd6e120bf553091…b2edfa97ef44in 1 report
- hxxps://campanha1-api.ef971a42.workers[.]dev/api/installsin 1 report
- campanha1-api.ef971a42.workers[.]devin 1 report
- mxtestacionamentos[.]comin 1 report
- hxxps://campanha1-api.ef971a42.workers[.]dev/api/campaignin 1 report
- hxxps://arquivos-omie[.]comin 1 report
- arquivos-omie[.]comin 1 report
Copy these 17 indicators · defanged
Also named with it: CVE-2025-26399, CVE-2025-40551, CVE-2025-40536
Thanks — we review every report.