Loading story…
Bishop Fox published research showing that website favicons can be used as a practical reconnaissance signal to identify internet-exposed software, infrastructure, and decoys at scale. The work describes an AI-assisted workflow that hashes favicons with MurmurHash3, correlates results with Shodan data, and enriches findings through human review to map products, vendors, honeypots, and parking pages. The research says favicons are often stable, distinctive, and sometimes reachable even when applications are otherwise shielded by WAF or SSO controls, making them useful for passive pivoting and attack-surface intelligence.
Using a dataset of more than three million favicon entries, the researchers reported several notable findings, including signs that apparent cPanel exposure may be inflated by honeypots, attribution of infrastructure linked to Shadowserver Foundation and Thinkst Canary, and exposed Firefox noVNC sessions uncovered during enrichment. The report also notes that favicon handling is grounded in standard browser behavior defined by the HTML specification, but warns that favicon hashes are indicators rather than definitive proof of product identity, and presents the released repository as a starting point for further attack-surface mapping and validation.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Bishop Fox published research describing an AI-assisted methodology for fingerprinting internet-exposed software using favicon hashing, Shodan data, and human-reviewed enrichment. The post also notes release of a repository and highlights findings including honeypot attribution and exposed Firefox noVNC sessions discovered during enrichment.
The HTML Standard reference describes how user agents process icon-related link types such as `icon`, providing standards context for browser favicon handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers highlighted favicon hashing as a practical way to uncover malicious web infrastructure, showing that the small icon files used by websites can act as reusable fingerprints for phishing pages, command-and-control panels, and exposed directories. SANS demonstrated the technique by calculating the MurmurHash of Microsoft’s favicon and querying Shodan for matching sites, then narrowing results with page text and hosting filters to identify fake Microsoft login portals used for credential theft. Additional research expanded the method beyond single-brand phishing to broader infrastructure hunting. SentinelOne described tracking reused web artifacts such as favicons, trackers, outgoing links, and downloaded files to uncover fake AWS and USPS-themed phishing sites as well as **Kimsuky**-linked infrastructure, while a separate threat hunting note compiled favicon hashes tied to numerous malware families, C2 frameworks, and criminal web panels. Together, the reports show that defenders can use favicon-based searches and related network indicators to find phishing domains, exposed attacker tooling, and malware control servers at low cost.
Aug 15, 2026
Researchers detailed how the **Havoc** command-and-control framework, an open-source post-exploitation platform built for red teaming, is being used in real intrusions and can be identified through distinctive network and host artifacts. The analysis describes Havoc’s architecture, beaconing, payload generation, and sleep-obfuscation, and says defenders can spot traffic by looking for the default `0xDEADBEEF` magic value, Havoc `AgentID` patterns, and its **AES-CTR** encryption workflow in packet captures and memory. The report says encryption keys used to inspect Havoc traffic can be recovered from several sources, including modified source code, the teamserver **SQLite** database, packet captures, and memory dumps. It also highlights defensive tooling released to support investigations, including a **YARA** rule, a **Volatility** plugin, and a Python parser for decrypting and analyzing Havoc communications, while noting that SIEM visibility is weaker when operators rely on **BOFs** for stealth and stronger when they use shell or PowerShell tasking that leaves traces in Windows logs and Elastic.
Aug 14, 2026
Microsoft reported that a macOS-focused **ClickFix** campaign evolved from openly serving fake download pages to using server-side browser fingerprinting that shows the malicious lure mainly to likely macOS victims. The operation used more than **250 look-alike domains**, often following dictionary-style naming patterns that included the token `file`, and presented spoofed **GitHub-themed** pages with a fake **Download for macOS** prompt. Victims were tricked into pasting a Terminal command that fetched remote scripts and installed infostealers including **Atomic Stealer (AMOS)** and **MacSync**. The gating logic collected browser, hardware, and anti-analysis signals before deciding whether to deliver the lure, including `navigator` data, WebGL GPU details, timezone, iframe status, touch support, console serialization behavior, and prototype-tamper checks; non-qualifying visitors were sent blank or benign decoy pages. Separate IOC material tied the same broader activity to additional macOS infostealer infrastructure, including **SHub Stealer**, suspected delivery and command-and-control domains, a SHA-256 sample hash, and capabilities such as screenshot capture, file download, command execution, and self-deletion, reinforcing that the campaign relied on rotating lure domains and stealthy staging to target macOS users.
Aug 27, 2026