hxxps://paste[.]sh/dQfdExjo#AqjB4BBtURL
Reported by 1 independent source · first reported by Cisco Talos · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2“The instructions then directed the targets to a link to a new source script on “paste.sh” to be added to the plugin (“hxxps://paste[.]sh/dQfdExjo#AqjB4BBt]lwLt2NKrlC0x8J9O”).”
Indicators reported together
named in the same reports- hxxps://docs.google[.]com/spreadsheets/d/in 1 report
- swapzone[.]ioin 1 report
- simpleswap[.]ioin 1 report
- obfuscator[.]ioin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.