[
  {
    "type": "DOMAIN",
    "value": "idp.keyreniao.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "idp.korminel.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "idp.kualabemo.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "int.camberwolis.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "mslogin.milocaroline.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "msauth.monlinelogicaline.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "msonline.logicalineonline.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "office.ofreace.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "office.ofercarc.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "office.ofrecie.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "office.ofreice.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "office.ofrecre.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "office.ocrifere.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "office.ocifire.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "login.oficarine.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "login-microsoftonline.offirmtm.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "wisemediapa-ttern.digital",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "sky2025forge.digital",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "skyprimeworks.digital",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "1systemsevolve.digital",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "xsyst-emsquantum.digital",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "tec-hnoplatform2025.digital",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "evolveelevateunion.digital",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "offirmtm.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "keyreniao.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "korminel.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "kualabemo.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "milocaroline.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "monlinelogicaline.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "logicalineonline.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "ofrecie.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "ofreace.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "ofreice.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "ofrecre.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "ofercarc.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "ocrifere.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "ocifire.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "DOMAIN",
    "value": "oficarine.com",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "IP_ADDRESS",
    "value": "153.92.1.166",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "IP_ADDRESS",
    "value": "72.62.0.181",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "IP_ADDRESS",
    "value": "31.97.76.103",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "IP_ADDRESS",
    "value": "177.7.56.248",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "IP_ADDRESS",
    "value": "187.124.129.44",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "IP_ADDRESS",
    "value": "194.5.157.204",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "IP_ADDRESS",
    "value": "145.223.100.123",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "URL",
    "value": "https://msonline.logicalineonline.com/https://login.microsoftonline.com/common/GetCredentialType",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "URL",
    "value": "https://msonline.logicalineonline.com/https://login.microsoftonline.com/common/login",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "URL",
    "value": "https://msonline.logicalineonline.com/https://login.microsoftonline.com/common/SAS/BeginAuth",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "URL",
    "value": "https://msonline.logicalineonline.com/https://login.microsoftonline.com/common/SAS/EndAuth",
    "published": "2026-08-13T11:52:42+03:00",
    "briefs": "Payroll Pirates: Microsoft 365 Adversary-in-the-Middle Campaign Hijacking Finance and Payroll Mailboxes"
  },
  {
    "type": "IP_ADDRESS",
    "value": "207.174.0.143",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "IP_ADDRESS",
    "value": "142.202.191.225",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "IP_ADDRESS",
    "value": "207.189.11.170",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "IP_ADDRESS",
    "value": "207.174.1.249",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "IP_ADDRESS",
    "value": "172.81.61.100",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "DOMAIN",
    "value": "blog.derrspecial-onlinedmin.live",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "DOMAIN",
    "value": "crestmarkhq.com",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "DOMAIN",
    "value": "subscription-magnetic-recommended-meat.trycloudflare.com",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "DOMAIN",
    "value": "sporting-delhi-cork-pursuit.trycloudflare.com",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "DOMAIN",
    "value": "delayed-earthquake-personnel-asset.trycloudflare.com",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "DOMAIN",
    "value": "sun-cheats-scientists-pastor.trycloudflare.com",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "URL",
    "value": "https://dropbox.com/scl/fi/a0hp9g4w2ddkb3ggnkivx/",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "9161a8f7f07741db06b9f9a87b6ec7f277faf2ae3a3a661d6eb09cec4e12b920",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "35be1b070f06eb313c3cb818c74aa0a9c2d9f39a05621dac4de6cff6067a5d12",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "31260c37cc442719ac84540f4159dd9d4738575d2ab05e92c751a9b4b5f9b91b",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "371166ebd83e8318b49ba71321396524fbca7dc42fe1ca4badda8af794bf5a59",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "63c46b3c090a4b1efef146f2f1efc4f93d44f21db21d7825f43e02c3c5c89de6",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "433b61c29aefaa5b55fe78063e6ad8597d3835f36e1242d5402ab23e6dc61194",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "c8695906dcefc64becb3123fa0a8058278c8c2f9c86130956b6b10d49c1a35dc",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "9d9f3fa5aaf6bc91091873bd7ee04f0cc23e8709e4ad20c61d2779ff1a43c4b4",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "873011c181d00709fdf66f32bb3cca0c5ff3147d00ef818fef72987a6773ea66",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "2423decbfcf820f41bc356547e4e18e61d60c9829421d7121c374dcef88577f7",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "8e87a734daddd95322b3f18f71eb9275219e244aac4f62b8dc6da6e2e91525e9",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "dd23012b4dc29cf7901185ae4fb2d507e737e9ea4d467846eafd6a86b26486bf",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "3cd9b7d583442963261f9985128042bf45d25482efcbf903c9248837cb0d744b",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "01e4cb3c60fa50b2927daa11f25a3c412549680406fc121a3d1870a9a33f5d38",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "60c730addd2a15e4213a1d37f55186686976de73a106317b5a258fe0121cfd5c",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "aa84e2ac68f7fc18f4927b89be7b4a7739f2eaf099e489aa0f65c1d3913ce62a",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "639430a33c0ecdf5a134501788a3a40f065ae4232efc66e1b82eca2b355e0606",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "aefac65c42c0c72ed3e08b32774fa1b902f4fd1d53de189d50f38130cc357764",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "88dfa217ef342de56b73625a64196b30aed7ac18dbe3d6d046408f3646146a07",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "ad9794b209b7b1d09b2247b87e0762a6d63d082f97788cc1f07ca7782b84011a",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "fecdf82a8a8100e5e848f3380ebba7718e80a352c781216dd1f896021311686d",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "28287d944654bc5cd118ea37f93903adf327459ce51c1042633d3725d39eeea2",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "zoom-update.vbs",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "RSKAdvGrpSupportingdocuments.vbs",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "SystemCheck.gzip",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "WindowsExplorerSupport.msi",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "working_payload.cs",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "AdobeReader_Update.exe",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "Document-Viewer.exe",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "ZoomUpdateInstaller.pkg",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "Zoomupdateinstaller.msi",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "Zoomupdateinstaller.exe",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "Document-review.msi",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "DocumentReview.msi",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "SystemCheck.msi",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "FILE_NAME",
    "value": "MemoryLoader.cs",
    "published": "2026-08-12T11:05:33+03:00",
    "briefs": "SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels"
  },
  {
    "type": "DOMAIN",
    "value": "ms365-device.com",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "DOMAIN",
    "value": "ms365-live.com",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "DOMAIN",
    "value": "m365-owa.com",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "DOMAIN",
    "value": "owa-ms365.com",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "IP_ADDRESS",
    "value": "31.57.243.154",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "IP_ADDRESS",
    "value": "38.146.28.75",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "IP_ADDRESS",
    "value": "104.194.159.150",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "IP_ADDRESS",
    "value": "104.145.210.184",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "IP_ADDRESS",
    "value": "38.146.28.132",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "IP_ADDRESS",
    "value": "107.189.26.194",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "IP_ADDRESS",
    "value": "213.145.86.112",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "IP_ADDRESS",
    "value": "192.142.52.31",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery"
  },
  {
    "type": "FILE_NAME",
    "value": "svchost32.exe",
    "published": "2026-08-09T17:47:11+03:00",
    "briefs": "CaptiveCrunch: Storm-2945 Hijacks Captive Portal Traffic for Credential Theft and Malware Delivery; The Gentlemen Ransomware: Defense Evasion TTPs"
  },
  {
    "type": "DOMAIN",
    "value": "npm-cache.com",
    "published": "2026-08-05T11:07:01+03:00",
    "briefs": "Keyv and Cacheable npm Supply Chain Compromise: Mini Shai-Hulud Worm Stealing Developer and CI/CD Credentials"
  },
  {
    "type": "URL",
    "value": "https://npm-cache.com:443/router",
    "published": "2026-08-05T11:07:01+03:00",
    "briefs": "Keyv and Cacheable npm Supply Chain Compromise: Mini Shai-Hulud Worm Stealing Developer and CI/CD Credentials"
  },
  {
    "type": "DOMAIN",
    "value": "js-mirror.com",
    "published": "2026-08-05T11:07:01+03:00",
    "briefs": "Keyv and Cacheable npm Supply Chain Compromise: Mini Shai-Hulud Worm Stealing Developer and CI/CD Credentials"
  },
  {
    "type": "DOMAIN",
    "value": "pypi-get.com",
    "published": "2026-08-05T11:07:01+03:00",
    "briefs": "Keyv and Cacheable npm Supply Chain Compromise: Mini Shai-Hulud Worm Stealing Developer and CI/CD Credentials"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc",
    "published": "2026-08-05T11:07:01+03:00",
    "briefs": "Keyv and Cacheable npm Supply Chain Compromise: Mini Shai-Hulud Worm Stealing Developer and CI/CD Credentials"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668",
    "published": "2026-08-05T11:07:01+03:00",
    "briefs": "Keyv and Cacheable npm Supply Chain Compromise: Mini Shai-Hulud Worm Stealing Developer and CI/CD Credentials"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb",
    "published": "2026-08-05T11:07:01+03:00",
    "briefs": "Keyv and Cacheable npm Supply Chain Compromise: Mini Shai-Hulud Worm Stealing Developer and CI/CD Credentials"
  },
  {
    "type": "SHA1_FILE_HASH",
    "value": "686aa40d0fc22c8d569494543a0f891f359f2f99",
    "published": "2026-08-05T11:07:01+03:00",
    "briefs": "Keyv and Cacheable npm Supply Chain Compromise: Mini Shai-Hulud Worm Stealing Developer and CI/CD Credentials"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "9136ffb749c6cec13b826cd4f25ffdcf170375889feba9fee28dd74c32578f52",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "66b2b22397cea219266afb8cbbb28fe93997c1444f642a183ac8fc9ca1fabed5",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "7dcabb6d07d52b92bbf8d659d1ed373fa780e7839fd3d744826a56fc1cd2372f",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "35ea50f16bd5c080c91dbaa3dd4937408ed9563c1d9aa1cd0c751ae58db0eedc",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "759287052b8cc4f4ce16065857cbc9dba72aab218e709d3419483a95092c6f96",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "f36bfccf944b5d1e5e306958c1a728e38786c042ee4e536cc44c9d43940b1121",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "51edd14233483bcf36e0b0f31451f28eac681fe3f2036f76c02b7ec1bb17ce33",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "5d53246b0e6b681bc624739a7bead39a61fb07c0f4474b8170112e829c053f85",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "65af5c3ba2d00967b25b9165d2d3171fa81f209ee0790299805bb907d492a670",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "41748648b71a70431123ec48e38868ff8aad3a7a06f5d781c2d2a4f718e7fd91",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "f85960dee17ba587b712cd8cdf89042bcd6ba711c3d5d548bef7c7f0988413f5",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "scansec-upd.com",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "re2.filesdwnload.top",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "re8.dowlfles.online",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "update19.upldf.online",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "re102.fastwinnow.com",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "URL",
    "value": "https://re102.fastwinnow.com/download/link",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "IP_ADDRESS",
    "value": "5.253.59.222",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "IP_ADDRESS",
    "value": "94.140.114.192",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "IP_ADDRESS",
    "value": "193.29.57.37",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "IP_ADDRESS",
    "value": "45.86.162.228",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "IP_ADDRESS",
    "value": "46.30.191.126",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "IP_ADDRESS",
    "value": "46.30.191.60",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "IP_ADDRESS",
    "value": "185.82.126.91",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "xeds.geranteeg.online",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "FILE_NAME",
    "value": "appscreen.log",
    "published": "2026-08-03T17:28:00+03:00",
    "briefs": "Helpdesk Hijackers: Teams Vishing and Quick Assist Access Delivering the GoGRPC Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "fg777-srv.top",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "patxisdublin.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "jetourmexico.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "lunabybodyshaping.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "dbqu.highkickstkd.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "uumt.opulentbeautybarllc.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "zvuy.comptonanimalrescue.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "ljxh.patxisdublin.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "bikertlane.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "bittersweetkennel.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "bolesfarms.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "borrender.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "burritodelight.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "cardanaircraft.org",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "cheaperthan-dirt.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "cleantruckchecksac.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "closedfistllc.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "colg1.org",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "comptonanimalrescue.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "concretewestgj.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "corgiwarehouse.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "customhomebuildersplainfield.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "dermatologycongress.org",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "dermexcel.net",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "diamonddumpsterrental.net",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "divanailsachse.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "domirunway.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "economywindowsparts.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "everestpointnorthglenn.org",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "ezgarageautorepairtx.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "nurtured-in-nature.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "finovestpedia.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "fit2leadconference.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "fontanayoga.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "frisbeeburgerllc.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "gobgem.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "goodlifelakerentals.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "hairbyniki.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "hayleymarienorman.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "highkickstkd.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "hurtigegevinster.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "jenslittlerugrats.org",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "kaltourusa.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "letstalkrocks.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "lnlsealcoating.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "loganlooneyresume.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "mechanic-on-site.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "missavws.net",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "monicarobles.org",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "opulentbeautybarllc.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "ordereltacofeliz.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "pacesettershomehealth.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "polarstartire.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "ricardotaxiservices.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "ridgerenovation.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "riggsjacksboro.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "rspmpanyabungan.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "scissormasterstanningsalon.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "sdcwoodcraft.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "seamsnstitches.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "shawnmaltipoopuppies.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "shopsoleilcollective.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "slepsluzbaublizini.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "snydersflowershop.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "solucionesintegralesgiraldo.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "spacedecorideas.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "spencershorttexas.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "springhillcommons.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "stable-virtual-camera.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "studiofourfitnessnv.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "taqueriadonamariaky.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "thebrandus.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "thechildrencomefirst.org",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "thelegalexpertise.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "thetokestudio.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "trueamatuermodels.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "upthesmokee.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "vitalmcallen.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "wellcome-c-store.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "whitelaneint.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "windhorseevents.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "aimhighbasketballcamp.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "alliancecarerx.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "apk.yumaneed.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "ashleynewsome.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "atwaternaz.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "auraapp.org",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "bbibeautyshop.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "bedfordrealtycorp.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "bibisafricanhairbraids.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "breezybowlhouston.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "breezybowlstlouis.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "dcsplumb.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "design.yumaneed.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "enjoyflowersbusiness.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "glendoradentalcenter.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "human.yumaneed.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "infinitymakeoverstudio.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "internationaltreeservice.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "matecfilterpress.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "mcbridervpark.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "mobile.breezybowlhouston.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "mobile.yumaneed.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "modelstvseries.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "project.yumaneed.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "protransportationservice.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "rohamsport.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "rsudtarutung.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "seattle-immigrationlawyer.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "store.ridgerenovation.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "story.yumaneed.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "taxi88.ashleynewsome.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "thehairspotsalon.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "tmowersnstuff.com",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "IP_ADDRESS",
    "value": "45.140.14.113",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "wss.vectorplatform.cc",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "quorashift.cc",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "static.quorashift.cc",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "gw.portallbridge.cc",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "DOMAIN",
    "value": "xss.gumminessheap.in.net",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "40bc68612f43cdf66737784640a706efdbdad24c0423d5e08ef47cc6ebd97ffc",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "99279a25c028fc85747e68521fc5dee135bcfa01602fd3109cba81959db476d4",
    "published": "2026-07-28T18:23:04+03:00",
    "briefs": "ClearFake ClickFix Intrusion: WebDAV-Delivered Multi-Stealer Chain with Blockchain-Resolved Backdoor and DLL Side-Loading"
  },
  {
    "type": "URL",
    "value": "https://claude.ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877",
    "published": "2026-07-27T14:47:58+03:00",
    "briefs": "FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2"
  },
  {
    "type": "DOMAIN",
    "value": "claude.ai.download-app.us",
    "published": "2026-07-27T14:47:58+03:00",
    "briefs": "FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2"
  },
  {
    "type": "DOMAIN",
    "value": "download-app.us",
    "published": "2026-07-27T14:47:58+03:00",
    "briefs": "FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2"
  },
  {
    "type": "DOMAIN",
    "value": "downloading-api.it.com",
    "published": "2026-07-27T14:47:58+03:00",
    "briefs": "FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2"
  },
  {
    "type": "URL",
    "value": "https://downloading-api.it.com/html/claude/win",
    "published": "2026-07-27T14:47:58+03:00",
    "briefs": "FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2"
  },
  {
    "type": "DOMAIN",
    "value": "polse.us",
    "published": "2026-07-27T14:47:58+03:00",
    "briefs": "FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2"
  },
  {
    "type": "DOMAIN",
    "value": "5ca8758c-02d0-4a72-89c8-d468b66dda41.com",
    "published": "2026-07-27T14:47:58+03:00",
    "briefs": "FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "26bae4d7012bf59847ab4036a065419c3d4ca47e020479f55b3b2c6d0d21394a",
    "published": "2026-07-27T14:47:58+03:00",
    "briefs": "FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "1cd58cfba596da296ab1878d74023e00c399345a1b6c2a0e5446c53563f4e3bb",
    "published": "2026-07-27T14:47:58+03:00",
    "briefs": "FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "1fe3646d27d286db8123297e06ae7badf3e26f352a04f91b6d82c28869a91664",
    "published": "2026-07-27T14:47:58+03:00",
    "briefs": "FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2"
  },
  {
    "type": "FILE_NAME",
    "value": "appcfg.dat",
    "published": "2026-07-27T14:47:58+03:00",
    "briefs": "FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2"
  },
  {
    "type": "IP_ADDRESS",
    "value": "2.24.131.246",
    "published": "2026-07-27T14:47:58+03:00",
    "briefs": "FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2"
  },
  {
    "type": "DOMAIN",
    "value": "cloudlanecdn.com",
    "published": "2026-07-22T13:57:41+03:00",
    "briefs": "HOLLOWGRAPH: Microsoft 365 Calendar Dead-Drop C2 and Graph API Exfiltration"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "75e51774b8f79e5f256eaae639635f911b3e744d4774fd6068dd980255621509",
    "published": "2026-07-22T13:57:41+03:00",
    "briefs": "HOLLOWGRAPH: Microsoft 365 Calendar Dead-Drop C2 and Graph API Exfiltration"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "f3f3006f8304788251b153d53b305322b8acab0c66ec816b8d9f101bcc851da3",
    "published": "2026-07-22T13:57:41+03:00",
    "briefs": "HOLLOWGRAPH: Microsoft 365 Calendar Dead-Drop C2 and Graph API Exfiltration"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "b3d0f6e4e3be395fd7cf9e8101c89963d77216578cbb117a6ac9bc3564485eff",
    "published": "2026-07-22T13:57:41+03:00",
    "briefs": "HOLLOWGRAPH: Microsoft 365 Calendar Dead-Drop C2 and Graph API Exfiltration"
  },
  {
    "type": "FILE_NAME",
    "value": "logAzure.txt",
    "published": "2026-07-22T13:57:41+03:00",
    "briefs": "HOLLOWGRAPH: Microsoft 365 Calendar Dead-Drop C2 and Graph API Exfiltration"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "a92d28f1d32e3a9ab7c3691f8bfca8f7586bb0666adbba47eab3e1a8faf7ecc0",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "1319d474d19eb386841732c728acf0c5fe64aa135101c6ceee1bd0369ecf97b6",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "3df9dcc45d2a3b1f639e40d47eceeafb229f6d9e7f0adcd8f1731af1563ffb90",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "c86ab27100f2a2939ac0d4a8af511f0a1a8116ba856100aae03bc2ad6cb0f1e0",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "cf3dfd1d6626fd2129abb7a5983c11827f4b0d497e2dba146a1889bd71f23cd5",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "IP_ADDRESS",
    "value": "77.110.107.235",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "IP_ADDRESS",
    "value": "93.123.39.127",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "IP_ADDRESS",
    "value": "172.86.126.208",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "IP_ADDRESS",
    "value": "116.203.208.186",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "IP_ADDRESS",
    "value": "172.86.76.127",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "DOMAIN",
    "value": "adm-pulse.com",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "DOMAIN",
    "value": "moonzonet.com",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "DOMAIN",
    "value": "uploadfiler.com",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "DOMAIN",
    "value": "serialmenot.com",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "DOMAIN",
    "value": "uppdatefile.com",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "DOMAIN",
    "value": "hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "DOMAIN",
    "value": "gitempire.s3.us-east-005.backblazeb2.com",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "DOMAIN",
    "value": "elvenforest.s3.us-east-005.backblazeb2.com",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "URL",
    "value": "http://172.86.126.208:443/ms_upd.exe",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "FILE_NAME",
    "value": "ms_upd.exe",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "FILE_NAME",
    "value": "DIDS.exe",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "FILE_NAME",
    "value": "Game.exe",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "FILE_NAME",
    "value": "WebView2.exe",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "FILE_NAME",
    "value": "visualwincomp.txt",
    "published": "2026-07-22T10:15:48+03:00",
    "briefs": "MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams"
  },
  {
    "type": "IP_ADDRESS",
    "value": "136.243.203.109",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "IP_ADDRESS",
    "value": "136.243.203.111",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "IP_ADDRESS",
    "value": "138.199.246.13",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "IP_ADDRESS",
    "value": "116.203.243.208",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "DOMAIN",
    "value": "pool.supportxmr.com",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "097a87cfa4a5186aba3bba096866692951bde59c6f0c2e8c1c4a599246d14da8",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "201594c9d173bba6cb509407ecba378c19b93da0a81a2182a913c480e6dbb54e",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "20bf39e1e67152039e70a01ad9e7b23c08d23d2a724ef9c44903f3d4353a2275",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "35dde1b2482b12582820a861e7c46f10721af6b75052fc872c05d2230a4e8ca1",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "43920ef7d2742d140a1ab2a1ef172c716903474c73561377dc4f1534d2c5f581",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "47d6d1a38534ba897a5a1e293e3d5df303bbd8e0526e756ad08887ffc1417bef",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "68ced9d7c1b1ff8ffb5f56c7d3f849d4fd16a1b95324426811424b40043d6d25",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "6b7ff061eebeb9ead8812c410247768a7ba90786aeeb1bafa6412cc5b08237b5",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "739cdedb20de39aeb1f15dc8c2dbbf15fa993250fd879bf87443ff9aeaf4997b",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "74df77b6a83d89fa137fd285a2efde36b1d62c00b3be81cc93df7d1e6e94837b",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "8b40cc7d173efd27fb60f3d260acef28f58d67d1f39597e1d611db311a305f62",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "9656d3301f63ef6114289739a1c44082206298f787238fc6c190ad87eab24751",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "9b3df1b6c1b98c201de09a7719066f7bcae6b66a3173b703a617f53fddf67d51",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "a17a972a05afe387ed32aa2986d5be8bca2f22619d0aedfa834c6963abfab3bf",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "a4f979b4a5d7bc8bc455dd4c09b44e51a389576fccce35a2c8da3ce680237565",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "a64843ebfbc39e96ec7613003b1b5c3a9b878874ea15a05e1d34ce91781ebfb6",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "aaa2bc1128d8b8b2da76262bf87ede19bac053cca6576efba6aaa71c9438c304",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "b830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "bb30cc2b302d9a6963109b201b78d4163bb6c2d7bc8bf5a66e9a744b62fc2717",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "c328b78c21060e2203ac517833fce41572b91878e187f85fa434cd6914659834",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "c7a4a547eb7f6b0b4b75bb6dd8955244bb2618ba234ae740cdedd7c2d30e3465",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "d384c403c084967d8c967501ee6332b050af04ef424f13a3f5a88d155389d98c",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "d6446f2803444bd2200d48a01a9ad7d487e67e8e831c9cd13f89cbfec17fd4e2",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "d7c9c9469c513c05aa431fae34f414f91fcf3f794d3e76b6e4d0b92c4cd3ff2e",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "d8c1f96107a3349e62b3ab9afc60f62af9c89b6961b637a26b71e1230f2b3b8a",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "f0dcb7e407de85d8de8e2221df8dddecac8aec88af8975c9f07e14100f6edb88",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "0a6a67a2fc4d79ec1cd8afc5b8b7a5e69a406e53d57a7334e097c5d0644de5f6",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "488d941b7b4428b0f4a0e5495e3857b9b96215fb3e7f164b06640d59096425e6",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "5d7324d8b5a25f862ef8223c6766d0e80af3ad168e17312b265e13a3a68e0ded",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "7720e83c02a027d70ae201c393c1956aa2fa8199879a3a4c4fd1d20b03022cfd",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "7e49da0ae2f81e14841f356b4d69f0480c2d9ce3fab5a3fa91b0036d9a36fa0f",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "b8b5f6991a3a61083461d5269245bebf28b90934c328848ba8c1e084a5a6216c",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "b927d265fa29e471c1ae0d31516e480c09c0fb17f480ad08ea8d5b73e84b7a1b",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "b9b6893fa6b04ee8daa29e515c08239ac5204af1a1fa2bc10006eede1b41329b",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "c7c37a973b14edd5b6b2da4a1497c593e43640735ff54aecc9a3288fa5e548e3",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "d2148a458da46e81702136aa915312d360805f083d1f37ff5531db9fbdb8ad6d",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "d7b56818c829960b692de9ad5a14e52669d953e9f074f7218c3fe34ede4a11a0",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "db2a872f712fbdb1e347d06e29a9ed8278d86710ffc14ff04422be76e47124f4",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "e9e5e748ec5c0b811c8e60b0e55059edb4d2df86ff3ca45969e57d5fecb11a38",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "03e6f4f49cec3af38bbec9ed64c195c7a85a630ec989efb3669f04a2993c1dd7",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "914c18a04a2727bba9cecab78a1d516ec3c7a3f667e0e5a6081aa0e9206a69fe",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "d78082dc33c6dca98316e865efa9829c6eb5a97c2ca3cd4ea6c2123a5f6ae45b",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "15489bcd6e4602b41c9a787ec8d7ab027d5e45d400938048bb1c702ad5937980",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "169a330353e53a409e0109c914404354741ff1e1c64e501738dc05e58ea92abc",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "2a02ec4af5ed591afdf1236a443e3b68642ee133f38a2857d1eada51246ab498",
    "published": "2026-07-16T12:02:20+03:00",
    "briefs": "Vidar Stealer and XMRig X3D MINER Cracked Software Campaign"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "9b2e65db653ca8575c9b10eefb9a80c6006404812c2ec212bf5675e3c690233b",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "d425e4583cc6185d41e95c45eda00550045a5d1919b9a012236a4520d009dbd7",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "bfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "34014776d3d3ff11bc4439b02fd7ac0f02a887eb3a052eeafff236e2f6db8ad1",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "082d733db0687dcd768104972b065d4b58cb1e6043688c6c20fa3702337f36ab",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "9e214f38537e69bf51c7fa1ddd35ae495e9cb897231ec010baf9e4f29407ee9a",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "f873941d1907a97dc6c718fdecf59fd7d91f3f8212da2f7e5314b878b88bdc0b",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "550af477c12192a22f5c9edb9c8081c0a789b3a1a2992a7ecb157cca1c975e10",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "24b9ee242f21a73b55f7bb3297eafb33c60840907386b542ed79fc6b72365168",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "9f1a709310824f9110c6203d861a721ebefba8b204a8657057fe57efb961c850",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA1_FILE_HASH",
    "value": "22bf76fe317ea6769bd38619bd440e42d119bd6b",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA1_FILE_HASH",
    "value": "a7e18d96efd3cdb127ef4cdcad9e3ad26c482bf2",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA1_FILE_HASH",
    "value": "9890950adcbc2478e7a080234f053214adbad44e",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA1_FILE_HASH",
    "value": "c70e105e212ff3c1daa04bb2a62507717f296b0b",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "SHA1_FILE_HASH",
    "value": "c8cb3f6d5b90c46686d2bf531dc1a5786e27edc5",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "IP_ADDRESS",
    "value": "85.137.53.71",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "URL",
    "value": "http://85.137.53.71:8080/api/v1/beacon",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "URL",
    "value": "http://85.137.53.71:8080/api/v1/file-result",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "FILE_NAME",
    "value": "miasma-monitor.service",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "FILE_NAME",
    "value": "SIMULATION_WIPE_TRIGGERED.txt",
    "published": "2026-07-15T13:28:21+03:00",
    "briefs": "AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant"
  },
  {
    "type": "MD5_FILE_HASH",
    "value": "1ab58838e5790efb22f2d35ab98c0b7d",
    "published": "2026-07-09T23:49:02+03:00",
    "briefs": "ToddyCat APT's Umbrij Tool: Gmail OAuth Token Theft via DLL Sideloading and Browser Remote Debugging"
  },
  {
    "type": "MD5_FILE_HASH",
    "value": "a7d7d6c4c3f227f7117261c63b9e23a9",
    "published": "2026-07-09T23:49:02+03:00",
    "briefs": "ToddyCat APT's Umbrij Tool: Gmail OAuth Token Theft via DLL Sideloading and Browser Remote Debugging"
  },
  {
    "type": "MD5_FILE_HASH",
    "value": "3d3a621f852c42d97fd7260681e42508",
    "published": "2026-07-09T23:49:02+03:00",
    "briefs": "ToddyCat APT's Umbrij Tool: Gmail OAuth Token Theft via DLL Sideloading and Browser Remote Debugging"
  },
  {
    "type": "MD5_FILE_HASH",
    "value": "3432dd9ac0df80ef86eb80bd080f839b",
    "published": "2026-07-09T23:49:02+03:00",
    "briefs": "ToddyCat APT's Umbrij Tool: Gmail OAuth Token Theft via DLL Sideloading and Browser Remote Debugging"
  },
  {
    "type": "MD5_FILE_HASH",
    "value": "22aaeb4946ba6d2f2e27feb7dbb295de",
    "published": "2026-07-09T23:49:02+03:00",
    "briefs": "ToddyCat APT's Umbrij Tool: Gmail OAuth Token Theft via DLL Sideloading and Browser Remote Debugging"
  },
  {
    "type": "MD5_FILE_HASH",
    "value": "f61fbfb7aa1cd5dc8f70b055b51563e2",
    "published": "2026-07-09T23:49:02+03:00",
    "briefs": "ToddyCat APT's Umbrij Tool: Gmail OAuth Token Theft via DLL Sideloading and Browser Remote Debugging"
  },
  {
    "type": "MD5_FILE_HASH",
    "value": "f169d6d172dfb775895a5e2b1540c854",
    "published": "2026-07-09T23:49:02+03:00",
    "briefs": "ToddyCat APT's Umbrij Tool: Gmail OAuth Token Theft via DLL Sideloading and Browser Remote Debugging"
  },
  {
    "type": "IP_ADDRESS",
    "value": "176.123.4.44",
    "published": "2026-07-08T18:54:56+03:00",
    "briefs": "Storm-2949: Compromised Identity to Cloud-Wide Azure Breach"
  },
  {
    "type": "IP_ADDRESS",
    "value": "91.208.197.87",
    "published": "2026-07-08T18:54:56+03:00",
    "briefs": "Storm-2949: Compromised Identity to Cloud-Wide Azure Breach"
  },
  {
    "type": "IP_ADDRESS",
    "value": "185.241.208.243",
    "published": "2026-07-08T18:54:56+03:00",
    "briefs": "Storm-2949: Compromised Identity to Cloud-Wide Azure Breach"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "2abe5dd3a057fdef935722e50e9251c272d29fd26113187b853a1f9a9cb89d9b",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "79f7b67ce8b39070f3e1c2b90fce0ce84134782a7dedcccc1edac197ee9e089b",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "3b7ae925e2d64522b4f69b56285b05aeca8c5aab5ab46a9c02c4fafb69d881ce",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "cd4e5e2c65b1660470d3446539ee68adf5faeece3eaeb46583623be9911ee145",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "2ada24dd6e517f37942b749c2bd57ddd97445e9853002cee70a0bc30d0b0ce3a",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "IP_ADDRESS",
    "value": "77.110.122.58",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "IP_ADDRESS",
    "value": "213.165.41.26",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "cl.distritovagas.com",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "sonra.eutialyson.com",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "anus-staylard.xyz",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "pestrear-lamp.xyz",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "resumeacceptable.com",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "URL",
    "value": "https://cl.distritovagas.com/hte.hta",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "URL",
    "value": "https://sonra.eutialyson.com/inst24.msi",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "FILE_NAME",
    "value": "inst24.msi",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "FILE_NAME",
    "value": "cons_1.0.1.msi",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "FILE_NAME",
    "value": "hyper-v.ver",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "FILE_NAME",
    "value": "ek_kill_av.ps1",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "FILE_NAME",
    "value": "ek_disable_av.ps1",
    "published": "2026-07-02T15:36:20+03:00",
    "briefs": "Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor"
  },
  {
    "type": "DOMAIN",
    "value": "cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad.onion",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "DOMAIN",
    "value": "gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad.onion",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "DOMAIN",
    "value": "he5vnov645txpcv57el2theky2elesn24ebvgwfoewlpftksxp4fnxad.onion",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "DOMAIN",
    "value": "lyhizqy2js2eh6ufngkbzntouiikdek5zsdj3qwa22b4z6knpqorgiad.onion",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "DOMAIN",
    "value": "j3bv7g27oramhbxxuv6gl3dcyfmf44qnvju3offdyrap7hurfprq74qd.onion",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "DOMAIN",
    "value": "shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "DOMAIN",
    "value": "7goms4byw26kkbaanz5a5u5234gusot7rp5imzc3ozh66wwcvmcudjid.onion",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "DOMAIN",
    "value": "facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "DOMAIN",
    "value": "wt26llpl5k6gok3vnaxmucwgzv2wk3l7nuibbh25clghrtus3p5ctsid.onion",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "DOMAIN",
    "value": "ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "7630debd35cac6b7d58c4427695579b3e3a8b1cc462f523234cd6c698882a68c",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "a7abf1d9d6686af1cefcd60b17a312e7eb8cfe267def1ec34aeab6128c811630",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "23c1e673f315dafa14b73034a90dd3d393a984451ff6601b8be8142be6487b43",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "cf9fc891ea5ca5ecd8113ef3e69f6f52ff538b6cccbdaa9559106fc72bc6da30",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "100407796028bf3649752d9d2a67a0e4394d752eb8de86daa42920e814f3fae8",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "d14b80cbd1a19d4ad0473a0661297f8fdf598e81ff6c4ab24e212dcad2e54b3f",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "9d90f54ae36c6c5435d5b8bed40faf54cc91f6db28574a6310b5ffaeb0362e96",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "67fc5cf395e28294bbb91ed0e954fdf2e80ebd9119022a115a42c286dc8bacf5",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "0020d23b0f9c5e6851a7f737af73fd143175ee47054931166369edd93338538a",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "35a6bc44b176a050fd6824904b7604f0f45b0fdfa26bf9500b9e05973b387cfd",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "c824630154ac4fdfce94ded01f037c305eab51e9bef3f493c60ff3184a640502",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "d43bf94f0cb0ab97c88113b7e07d1a4024d1610617b5ad05882b1dbab89e15ba",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "b2777b73a4c33ac6a409d475057843be6b5d32262ef28a1f1ff5bb52e3834c5f",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "7787a9a7d8ae393aa32f257d083903c4dc9b97a1e5b0458c4cd480d4f3cb5b05",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "f3b54984caca95fd496bcfe5d7db1611b08d2f5b7d250b43b430e5d76393f9e0",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "20db98af3037b197c8a846dbf17b87fc6f049c3e0d9a188f9b9a74d3916dd5e1",
    "published": "2026-07-01T12:00:39+03:00",
    "briefs": "CryptoBandits: Tor-Routed Crypto Clipper with USB Worm Propagation"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "56b08aa03bd8c0ea094cfeb03d5954ffd857bac42df929dc835eea62f32b09e0",
    "published": "2026-06-30T11:59:30+03:00",
    "briefs": "Medusa Ransomware - RaaS Double Extortion Against Critical Sectors"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "baa980ae253101066ae7e551a354116454e8697ff2154a907c9885770cdae4ae",
    "published": "2026-06-30T11:59:30+03:00",
    "briefs": "Medusa Ransomware - RaaS Double Extortion Against Critical Sectors"
  },
  {
    "type": "EMAIL",
    "value": "key.medusa.serviceteam@protonmail.com",
    "published": "2026-06-30T11:59:30+03:00",
    "briefs": "Medusa Ransomware - RaaS Double Extortion Against Critical Sectors"
  },
  {
    "type": "EMAIL",
    "value": "medusasupport@cock.li",
    "published": "2026-06-30T11:59:30+03:00",
    "briefs": "Medusa Ransomware - RaaS Double Extortion Against Critical Sectors"
  },
  {
    "type": "FILE_NAME",
    "value": "gaze.exe",
    "published": "2026-06-30T11:59:30+03:00",
    "briefs": "Medusa Ransomware - RaaS Double Extortion Against Critical Sectors"
  },
  {
    "type": "FILE_NAME",
    "value": "smuol.sys",
    "published": "2026-06-30T11:59:30+03:00",
    "briefs": "Medusa Ransomware - RaaS Double Extortion Against Critical Sectors"
  },
  {
    "type": "FILE_NAME",
    "value": "openrdp.bat",
    "published": "2026-06-30T11:59:30+03:00",
    "briefs": "Medusa Ransomware - RaaS Double Extortion Against Critical Sectors"
  },
  {
    "type": "FILE_NAME",
    "value": "powerfun.ps1",
    "published": "2026-06-30T11:59:30+03:00",
    "briefs": "Medusa Ransomware - RaaS Double Extortion Against Critical Sectors"
  },
  {
    "type": "FILE_NAME",
    "value": "!!!READ_ME_MEDUSA!!!.txt",
    "published": "2026-06-30T11:59:30+03:00",
    "briefs": "Medusa Ransomware - RaaS Double Extortion Against Critical Sectors"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "aaf5569c8e349c15028bc3fac09eb982efb06eabac955b705a6d447263658e38",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "013211c56caaa697914b5b5871e4998d0298902e336e373ebb27b7db30917eaf",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "57bd98dbb5a00e54f07ffacda1fea91451a0c0b532cd7d570e98ce2ff741c21d",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "b3b6a992540da96375e4781afd3052118ad97cfe60ccf004d732f76678f6820a",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "22c15a32b69116a46eb5d0f2b228cc37cd1b5915a91ec8f38df79d3eed1da26b",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "f7cda90174b806a34381d5043e89b23ba826abcc89f7abd520060a64475ed506",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "39b3d8a8aedffc1b40820f205f6a4dc041cd37262880e5030b008175c45b0c46",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "73fe8b8fb4bd7776362fd356fdc189c93cf5d9f6724f6237d829024c10263fe5",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "77b49c854afd6746fee393711b48979376fb910b34105c0e18a3fdc24ea31d5c",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "6a67a9769a55ec889a5dd4199b2fc08965d39d737838836853bc13c81c56a800",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "ed907d39efd5750236b075ca9fbb1f090d7bf578578c38faab24210d298a60ae",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "24a11a26a2586f4fba7bfe89df2e21a0809ad85069e442da98c37c4add369a0c",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "IP_ADDRESS",
    "value": "149.248.11.71",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "FILE_NAME",
    "value": "vsm-boot-monitordvcenter",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "FILE_NAME",
    "value": "vsm-monitordvcenter",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "MD5_FILE_HASH",
    "value": "8af1c3f39b60072d4b68c77001d58109",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "MD5_FILE_HASH",
    "value": "c65d7f8accb57a95e3ea8a07fac9550f",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "DOMAIN",
    "value": "ms-azure.azdatastore.workers.dev",
    "published": "2026-06-25T16:47:57+03:00",
    "briefs": "BRICKSTORM: UNC5221 Espionage Campaign Targeting VMware Infrastructure and Microsoft Identity"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "b122a9873bedf145ae2a7fd024b5f309007dbb025149f4dc4ac3f7e4f32a36a4",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "ae70dd4f6bc0d1c8c2848e4e6b51934626c4818dcb5af99d080ddbd7dc337185",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "4a8860240e4231c3a74c81949be655a28e096a7d72f38fbe84e5b37636b98417",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "b73de25c053c3225a077738a1fcbd9ca6966d7b3cd6f5494a30f0aa0eae55c7e",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "50eae63d3e24be9ca8803f4b5a0408aef97ee3fab7af018d8c2dde7c359edd65",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "1d1bf5e8c1539d2f05b1429235b8f4990f87036774be95157b315a7803dd5526",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "FILE_NAME",
    "value": ".pkg_history",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "FILE_NAME",
    "value": ".pkg_logs",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "FILE_NAME",
    "value": "system.bat",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "FILE_NAME",
    "value": "protocal.cjs",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "IP_ADDRESS",
    "value": "23.254.164.92",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "IP_ADDRESS",
    "value": "23.254.164.123",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "DOMAIN",
    "value": "teams.onweblive.org",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "DOMAIN",
    "value": "maskasd.com",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "URL",
    "value": "https://23.254.164.92:8000/update/49890878",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "URL",
    "value": "https://teams.onweblive.org/api/update/8555575039/4",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "URL",
    "value": "https://maskasd.com/8555575039",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "EMAIL",
    "value": "sergey2016@tutamail.com",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "EMAIL",
    "value": "ehindero2016@tutamail.com",
    "published": "2026-06-21T17:32:02+03:00",
    "briefs": "Mastra npm Supply Chain Compromise: easy-day-js Typosquat Dropper"
  },
  {
    "type": "IP_ADDRESS",
    "value": "142.11.200.186",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "IP_ADDRESS",
    "value": "142.11.200.187",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "IP_ADDRESS",
    "value": "142.11.200.188",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "IP_ADDRESS",
    "value": "142.11.200.189",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "IP_ADDRESS",
    "value": "142.11.200.190",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "DOMAIN",
    "value": "azurenetfiles.net",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "URL",
    "value": "wss://azurenetfiles.net:443/agent.ashx",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "SHA256_FILE_HASH",
    "value": "2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "FILE_NAME",
    "value": "meshagent32-azure-ops.exe",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "FILE_NAME",
    "value": "meshagent64-azure-ops.exe",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  },
  {
    "type": "FILE_NAME",
    "value": "README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT",
    "published": "2026-06-18T16:27:33+03:00",
    "briefs": "ShinyHunters Exploits Oracle PeopleSoft Zero-Day"
  }
]