CIRCLE WITH A DOT

Detected #SmartApeSG infection chainCompromised site -->cpajoliette[.]com/q (injected) -->gralino[.]top/realm/throttle-template.php -->gralino[.]top/realm/role-asset.js (clickfix) -->vexnali[.]com/cc/info (HTA)

Detected #SmartApeSG infection chainCompromised site -->www[.]ski-snowboardvancouver[.]ca/d.js (injected) -->fresicrto[.]top/session/router-build.js -->fresicrto[.]top/session/route-header.php -->fresicrto[.]top/session/scope-schema.js (clickfix) -->urotypos[.]com/cd/temp (HTA) -->urotypos[.]com/ls/production (ZIP)a6a748c0606fb9600fdf04763523b7da20b382b054b875fdd1ef1c36fc16079a production

Detected #SmartApeSG infection chainCompromised site -->cpajoliette[.]com/q (injected) -->dsfeuyyd[.]top/throttle/policy-client.php -->dsfeuyyd[.]top/throttle/health-stylesheet.js (clickfix) -->poqwserty[.]com/user/me (HTA) -->poqwserty[.]com/reviewer/document (ZIP)5ef1ac71ab40e2ff87dbef0912a18d0c31901939af7b59bc24a5921e39a48293 document

Detected #SmartApeSG infection chainCompromised site -->cpajoliette[.]com/q (injected) -->dsfeuyyd[.]top/throttle/policy-client.php -->dsfeuyyd[.]top/throttle/health-stylesheet.js (clickfix) -->poqwserty[.]com/user/me (HTA)

New #SocGholish C2:hXXps://cpanel.baeinevand.eu[.]org/XgdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw==cpanel.baeinevand.eu[.]org107[.]175.88.57AS36352 HostPapa

Detected #SmartApeSG infection chainCompromised site -->treidoveir[.]top/health/health-css.php -->treidoveir[.]top/health/identity-effect.js (clickfix) -->dementiond[.]com/old/version (HTA)

Detected #KongTuke infection chainCompromised site -->aawbi[.]com/5232f.js -->aawbi[.]com/js.php (ClickFix) -->artsselection[.]com/bookmarks (Powershell)3b12fea31ace4c4d105c0f9f3e7c85d29bd18b5bef5fbde38043ebdff483abe0 bookmarks

Detected #SmartApeSG infection chainCompromised site -->thesnackbee[.]com/j.js (injected) -->vcterypore[.]top/beta/api-sandbox.php -->vcterypore[.]top/beta/rate-css.js (clickfix) -->otrypity[.]com/monitoring/ready (HTA)

Detected #SmartApeSG infection chainCompromised site -->cpajoliette[.]com/d.js (injected) -->redsiout[.]top/beta/proxy-deploy.js -->redsiout[.]top/beta/api-sandbox.php -->redsiout[.]top/beta/rate-css.js (clickfix) -->otrypity[.]com/monitoring/ready (HTA)

Detected #KongTuke infection chainCompromised site -->voginc[.]com/58hgs.js -->voginc[.]com/js.php (ClickFix)

Detected #KongTuke infection chainCompromised site -->flatheadcat[.]com/7s99.js -->FlatheadCat[.]com/js.php (ClickFix)

Detected #SmartApeSG infection chainCompromised site -->dist-ctroy[.]top/tenant/refresh-request.php -->dist-ctroy[.]top/tenant/session-sandbox.js (clickfix) -->certiouts[.]com/user/content (HTA)

Detected #SmartApeSG infection chainCompromised site -->dist-ctroy[.]top/tenant/refresh-request.php -->dist-ctroy[.]top/tenant/session-sandbox.js (clickfix)

Detected #KongTuke infection chainCompromised site -->unanistan[.]com/5gw2.js -->unanistan[.]com/js.php (ClickFix) -->sellmeyourbiz[.]com/customers (Powershell)699fd7a8d69c2a7fa84786794e318cf1ef41631ac4b3181e65cbbaf06b0ec17b customers

Detected #SmartApeSG infection chainCompromised site -->cpajoliette[.]com/q (injected) -->retrypoti[.]top/endpoint/login-asset.php -->retrypoti[.]top/endpoint/handler-css.js (clickfix) -->forcebiturg[.]com/boot (HTA)

Detected #KongTuke infection chainCompromised site -->elenviel[.]com/4s2h.js -->elenviel[.]com/js.php (ClickFix) -->salelegalsteroids[.]com/enterprise (Powershell)aaf1d5be8ba2de0d02d84d5aabdbf1fd35ffe78270506bfed9507fabd8f8fa8c enterprise

Detected #SmartApeSG infection chainCompromised site -->cpajoliette[.]com/q (injected) -->retrypoti[.]top/endpoint/login-asset.php -->retrypoti[.]top/endpoint/handler-css.js (clickfix)

New #SocGholish C2:hXXps://files.jeaniescott[.]digital/XgdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw==files.jeaniescott[.]digital104[.]194.222.207AS22653 Cyber Wurx LLC

Detected #SmartApeSG infection chainCompromised site -->trofedi[.]top/reset/tenant-pipeline.php -->trofedi[.]top/reset/private-compiler.js (clickfix) -->amfredio[.]com/server (HTA) -->amfredio[.]com/success (ZIP)e2f0d2243a95db379dd75de57fb98ffbc421cd58e9d11a2ca5a842540db9ba6a success

New #SocGholish C2:hXXps://feedback.grovecitypestcontrol[.]com/XgdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw==feedback.grovecitypestcontrol[.]com66[.]42.85.143AS20473 The Constant Company, LLC