Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A modular malware toolkit and cybercrime operation delivered via ClickFix-style fake CAPTCHA lures on compromised WordPress sites. It uses multi-stage PowerShell and .NET loaders to deploy components including a file encryptor, SMB/USB worm, screen locker, credential stealer, VBS spreader, and attacker chat tool, while also supporting stealthy data theft and surveillance.
A newly identified criminal operation centered on the StopAndProtect malware toolkit. It uses ClickFix and PowerShell/.NET loaders, abuses compromised WordPress sites for staging/C2/exfiltration, and can encrypt files, steal documents and credentials, spread via SMB/USB and VBS, lock the screen, and support operator-victim chat. The operation does not always deploy ransomware; in many cases it silently exfiltrates file listings and selected files.
A newly identified multi-component cybercrime operation delivered via ClickFix and compromised WordPress sites. It includes staged PowerShell/.NET loaders plus payloads for file encryption, data theft, credential theft, lock screen extortion, lateral spread via SMB/USB and VBS, and operator-victim chat. The campaign also exfiltrates logs, screenshots, file listings, documents, wallet/password files, and supports hands-on-keyboard targeting.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.