Loading story…
Researchers found an open directory and management panel tied to the CRPX0 malware operation at fanonlyatn[.]xyz, exposing the full source code, backend infrastructure, and operator details for a malware-as-a-service platform. The leaked materials showed a three-part criminal toolkit: a cryptocurrency clipboard hijacker supporting 10 coins, a BIP39 seed-phrase scanner and stealer, and ransomware for Windows, macOS, and Linux that appends the .crpx0 extension. The code and panel also exposed plaintext secrets, including a shared dashboard API secret, a loader password, ten hardcoded wallet addresses, and contact points linked to the operator, including the Telegram handle @DataBreachPlus, databreachplus@proton[.]me, and a qTox ID.
Analysis of the leaked infrastructure tied the operation to backup command-and-control and ransom-notification domains hosted on 31[.]31[.]198[.]206 through REG.RU, while the primary panel sat behind Cloudflare. The exposed files showed Windows routines to delete Volume Shadow Copies, macOS builder scripts aimed at bypassing Gatekeeper, and lures themed around fake FedEx shipping notices and fake OnlyFans account lists. Researchers also identified a separate exposed TwizAdmin panel at 103.241.66[.]238:1337 that pointed to additional infostealer functionality and suggested the campaign has been active since at least July 2025; one unusual artifact was ransomware wallpaper containing C2PA metadata indicating it had been generated with ChatGPT/GPT-4.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers analyzed an active multi-vector malware campaign delivering XWorm V6.0 and linked it with moderate confidence to a Turkish-speaking threat actor. The attribution was based on a public GitHub staging repository, Turkish-language filenames, and a GitHub commit email address.
Researchers identified a separate exposed TwizAdmin panel at 103.241.66[.]238:1337 linked to the CRPX0 operation. This panel confirmed additional infostealer functionality beyond the clipper, seed theft, and ransomware modules.
The exposed CRPX0 files revealed plaintext secrets including a dashboard API secret, loader password, ten hardcoded cryptocurrency wallet addresses, and operator contact details such as @DataBreachPlus and databreachplus@proton[.]me. Infrastructure analysis also tied backup C2 and notification domains to REG.RU-hosted systems at 31[.]31[.]198[.]206.
Breakglass Intelligence found an exposed panel at fanonlyatn[.]xyz that revealed the full source code and infrastructure for the CRPX0 malware-as-a-service operation. The leak exposed a centralized PHP dashboard, open self-registration, payment-code controls, and multi-platform malware components for Windows, macOS, and Linux.
Analysis of the exposed CRPX0 infrastructure indicated the malware operation had been active since at least July 2025. The campaign combined crypto clipping, seed phrase theft, and ransomware capabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 31 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Aryaka Threat Research Labs reported a multi-stage **CRPx0** malware campaign that tricks users searching for “free OnlyFans accounts” into opening a malicious ZIP archive containing a disguised shortcut. The shortcut launches hidden commands and a VBScript loader that prepares the host, installs components for Python-based malware, and connects to a remote server for interactive attacker control. Researchers said the operation targets **Windows** and **macOS**, with possible **Linux** support in development, and is built to blend into normal user behavior rather than rely on a single obvious malicious action. Once active, the malware supports clipboard-based cryptocurrency theft, credential and data harvesting, system reconnaissance, selective exfiltration, and eventual ransomware deployment in a **double-extortion** scheme. Stolen content reportedly includes documents, media, emails, and source code before files are encrypted with the `.crpx0` extension; the malware then changes the desktop wallpaper to a “gotcha” image and drops multilingual ransom notes directing victims to contact the operators via email, **qTox**, and **Telegram**. Reporting also said the group runs a leak site claiming 38 victims and more than 10,839 TB of leaked data, while offering access to stolen information for **$500** in cryptocurrency.
Jun 29, 2026
The **CRPx0** cybercrime operation has expanded from a scam service into a ransomware-as-a-service, cryptocurrency-theft, and white-label intrusion platform. Affiliates use ClickFix social-engineering pages impersonating Windows or macOS updates and Google reCAPTCHA to persuade targets to run malicious commands. On Windows, the reported chain uses clipboard-delivered PowerShell, encrypted DLL loaders, and a Python bootstrap; macOS victims may receive a portable Python environment and the ransomware payload directly. CRPx0 steals high-value data before encryption, attempts lateral movement, disables security controls, deletes backups, establishes persistence, and encrypts files with the `.crpx0` extension. Victims reportedly receive 48 hours to pay before stolen data is threatened with publication. The operation uses a clearnet PHP relay to proxy communications to Tor infrastructure and claims 47 victims, mainly in the United States and Turkey. Defenders should restrict ClickFix-prone execution paths, investigate suspicious `RunMRU` entries and pre-encryption exfiltration, block validated network indicators, and ensure backups cannot be accessed using compromised credentials.
Aug 28, 2026
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026