Loading story…
Security researchers highlighted favicon hashing as a practical way to uncover malicious web infrastructure, showing that the small icon files used by websites can act as reusable fingerprints for phishing pages, command-and-control panels, and exposed directories. SANS demonstrated the technique by calculating the MurmurHash of Microsoft’s favicon and querying Shodan for matching sites, then narrowing results with page text and hosting filters to identify fake Microsoft login portals used for credential theft.
Additional research expanded the method beyond single-brand phishing to broader infrastructure hunting. SentinelOne described tracking reused web artifacts such as favicons, trackers, outgoing links, and downloaded files to uncover fake AWS and USPS-themed phishing sites as well as Kimsuky-linked infrastructure, while a separate threat hunting note compiled favicon hashes tied to numerous malware families, C2 frameworks, and criminal web panels. Together, the reports show that defenders can use favicon-based searches and related network indicators to find phishing domains, exposed attacker tooling, and malware control servers at low cost.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
SentinelOne references a May 2023 campaign in which the North Korean-attributed actor Kimsuky evolved reconnaissance capabilities in a global operation using a malware component called ReconShark.
A USPS-themed phishing campaign reused Yandex Tracker ID 93030690 in tracking.php files across multiple phishing sites to collect victims' financial details. SentinelOne says this reuse linked infrastructure observed from April to July 2023.
A February 2023 campaign targeted cloud service credentials by impersonating AWS login pages and distributing phishing through emails and non-Google ads. SentinelOne describes detection logic based on reused AWS-related favicons and links to the legitimate AWS sign-in page.
A ReverseTheMalware blog post compiled favicon hashes for numerous malware families, C2 frameworks, and criminal web panels to support discovery of malicious infrastructure, including Mythic C2, Covenant, Amadey, Matanbuchus, and RisePro.
SentinelOne published guidance on tracking brand-impersonation infrastructure using VirusTotal NetIoc and reused artifacts such as favicons, trackers, outgoing links, and downloaded files. The article included examples tied to AWS phishing, USPS-themed phishing, and Kimsuky infrastructure.
A SANS ISC article states that Shodan added favicon-hash searching to help identify phishing kits, enabling defenders to search infrastructure by MurmurHash values of HTTP favicons.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
reversethemalware.blogspot.com
Open sourcesentinelone.com
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bishop Fox published research showing that website favicons can be used as a practical reconnaissance signal to identify internet-exposed software, infrastructure, and decoys at scale. The work describes an AI-assisted workflow that hashes favicons with **MurmurHash3**, correlates results with **Shodan** data, and enriches findings through human review to map products, vendors, honeypots, and parking pages. The research says favicons are often stable, distinctive, and sometimes reachable even when applications are otherwise shielded by WAF or SSO controls, making them useful for passive pivoting and attack-surface intelligence. Using a dataset of more than three million favicon entries, the researchers reported several notable findings, including signs that apparent **cPanel** exposure may be inflated by honeypots, attribution of infrastructure linked to **Shadowserver Foundation** and **Thinkst Canary**, and exposed **Firefox noVNC** sessions uncovered during enrichment. The report also notes that favicon handling is grounded in standard browser behavior defined by the HTML specification, but warns that favicon hashes are indicators rather than definitive proof of product identity, and presents the released repository as a starting point for further attack-surface mapping and validation.
Jul 24, 2026
Security researchers described how defenders can use passive OSINT sources to identify and cluster malicious internet infrastructure, particularly HTTP(S)-based command-and-control servers, by analyzing artifacts left behind in headers, response bodies, passive DNS records, and TLS certificates. The reporting highlights that attacker operational mistakes, infrastructure automation, and efforts to mimic legitimate services often create repeatable fingerprints that can be searched at scale across internet-exposed hosts. Censys demonstrated the approach with examples including **Cobalt Strike** servers that expose a characteristic HTTP `404` response pattern and infrastructure linked to **APT29** malware such as **WellMess** and **WellMail**, which could be tracked through distinctive self-signed certificate distinguished names. The guidance recommends combining host telemetry with certificate and DNS data, preserving historical results, and documenting queries so security teams can build durable visibility into adversary infrastructure and uncover related systems over time.
Aug 15, 2026
Researchers uncovered two large-scale malicious infrastructures that used Cloudflare-fronted domains and wildcard subdomains to hide centralized backend systems. In one campaign, investigators traced an **adversary-in-the-middle (AiTM)** phishing operation from four suspicious domains to at least seven domains and more than **200 subdomains** impersonating enterprise **VPN** and **SSO** portals, including Palo Alto GlobalProtect, Fortinet FortiGate, Cisco AnyConnect, Citrix, and Microsoft OWA. The phishing flow presented fake Cloudflare challenge pages before credential prompts, and the infrastructure was linked to a single origin server at `178.16.53.131` in Germany. Researchers said the platform could relay live authentication sessions and steal both credentials and session tokens, allowing attackers to bypass traditional MFA protections. A separate investigation tied a single ClearFake indicator to a broader malware delivery network spanning **24 `.in.net` domains**, more than **100 subdomains**, two Cloudflare account clusters, and a shared **WebDAV** origin server. Analysts found wildcard DNS and TLS certificates across the domains, identical `ETag` values indicating common hosting, and an exposed payload inventory accessible through unauthenticated WebDAV requests. The campaign used compromised websites to redirect victims to fake verification pages and then delivered malicious DLLs and two newly identified obfuscated Go binaries disguised as Logitech and Intel components. Breakglass reported that the recovered payloads had **zero detections** in VirusTotal and MalwareBazaar at the time of discovery, while multiple OPSEC mistakes—including leaked headers, an exposed staging directory, and a recurring "werification" typo—helped map the operation.
Jun 29, 2026