<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[The best time to block api]]></title><description><![CDATA[<p>The best time to block api.telegram[.]org was like, I dunno, five years ago? The second best time to do it is now.</p><p>Seriously. Cross that one off the easy wins list today.</p><p><a href="https://infosec.exchange/tags/ThreatIntel" rel="tag">#<span>ThreatIntel</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" rel="tag">#<span>ThreatIntelligence</span></a> <a href="https://infosec.exchange/tags/IFIN" rel="tag">#<span>IFIN</span></a></p>]]></description><link>https://board.circlewithadot.net/topic/75212f38-b146-4387-82a7-3eb66c2750ca/the-best-time-to-block-api</link><generator>RSS for Node</generator><lastBuildDate>Thu, 30 Apr 2026 14:19:49 GMT</lastBuildDate><atom:link href="https://board.circlewithadot.net/topic/75212f38-b146-4387-82a7-3eb66c2750ca.rss" rel="self" type="application/rss+xml"/><pubDate>Wed, 22 Apr 2026 15:25:32 GMT</pubDate><ttl>60</ttl><item><title><![CDATA[Reply to The best time to block api on Wed, 22 Apr 2026 15:44:53 GMT]]></title><description><![CDATA[<p><span><a href="/user/julie%40merida.hair" rel="nofollow noopener">@<span>julie</span></a></span> New-ish. We had a report of some ClickFix activity that used it, and was related to a recent Elastic report.</p><p><div class="card col-md-9 col-lg-6 position-relative link-preview p-0">



<a href="https://discourse.ifin.network/t/phantompulse-rat-macos-using-clickfix/302" title="PhantomPulse RAT (MacOS) using ClickFix">
<img src="https://discourse.ifin.network/uploads/default/original/1X/bc65858b598f025e033a3cec619dc2cdb560a3a4.webp" class="card-img-top not-responsive" style="max-height: 15rem;" alt="Link Preview Image" />
</a>



<div class="card-body">
<h5 class="card-title">
<a href="https://discourse.ifin.network/t/phantompulse-rat-macos-using-clickfix/302">
PhantomPulse RAT (MacOS) using ClickFix
</a>
</h5>
<p class="card-text line-clamp-3">Hi, 
EDIT: moved to news. 
We stumbled upon this when a user was “clickfixed” on a Mac. 

Command+space==&gt;Terminal, Enter 

The page is hosted in pages.dev (mandatory f..k Cloudflare). I can share the domain if you think&hellip;</p>
</div>
<a href="https://discourse.ifin.network/t/phantompulse-rat-macos-using-clickfix/302" class="card-footer text-body-secondary small d-flex gap-2 align-items-center lh-2">



<img src="https://discourse.ifin.network/uploads/default/optimized/1X/ea367a05f4a0d090bf61d140dc84f744c9ab9bf0_2_32x32.png" alt="favicon" class="not-responsive overflow-hiddden" style="max-width: 21px; max-height: 21px;" />





<p class="d-inline-block text-truncate mb-0">IFIN <span class="text-secondary">(discourse.ifin.network)</span></p>
</a>
</div></p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/115741367687413652/statuses/116449128830238514</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/115741367687413652/statuses/116449128830238514</guid><dc:creator><![CDATA[ifin@infosec.exchange]]></dc:creator><pubDate>Wed, 22 Apr 2026 15:44:53 GMT</pubDate></item><item><title><![CDATA[Reply to The best time to block api on Wed, 22 Apr 2026 15:29:58 GMT]]></title><description><![CDATA[<p><a href="/user/ifin%40infosec.exchange">@ifin@infosec.exchange</a> Y'all seeing some new stuff or is this just general advice?</p>]]></description><link>https://board.circlewithadot.net/post/https://merida.hair/notes/aldrwjssj7fb0002</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://merida.hair/notes/aldrwjssj7fb0002</guid><dc:creator><![CDATA[julie@merida.hair]]></dc:creator><pubDate>Wed, 22 Apr 2026 15:29:58 GMT</pubDate></item></channel></rss>