170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2cSHA-256 hash
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions“170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c Active from July 3 to July 14, 2026, it resembles the main lineage by retrieving its payload through /serve.php?l= and beaconing to its C2 through /testar_nova_versao/log_receiver.php, using the header X-Log-Token:…”
Indicators reported together
named in the same reports- 188.114.96[.]1in 1 report
- protonmail[.]comin 1 report
- 106eac79396a3ff7…635cbdc0fa42in 1 report
- 5ece7fd3766b0b7f…10e5be44f552in 1 report
- hxxps://connection.upgradeonline[.]sitein 1 report
- connection.upgradeonline[.]sitein 1 report
- hxxps://granderevolucao[.]store/5c92d3b8734b4f498752f735a1ca0987/in 1 report
- granderevolucao[.]storein 1 report
- hxxps://archive[.]org/download/hotelmoskva/hotelmoskva.jpgin 1 report
- hxxps://ia601808.us.archive[.]org/5/items/sentinel_20260722_0435/Sentinel.jpgin 1 report
- c8c38634dd44d7c6…81bdd66a4268in 1 report
- hxxp://www.creamp1eonlyfans[.]netin 1 report
- www.creamp1eonlyfans[.]netin 1 report
- hxxps://volmira[.]site/api/ext/versionin 1 report
- volmira[.]sitein 1 report
- hxxps://volmira[.]site/api/ext?p=98d8049e-804f-11f1-b79f-ae3a8bb85d01in 1 report
- hxxps://volmira[.]site//api/savecredsin 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.