Loading story…
The CRPx0 cybercrime operation has expanded from a scam service into a ransomware-as-a-service, cryptocurrency-theft, and white-label intrusion platform. Affiliates use ClickFix social-engineering pages impersonating Windows or macOS updates and Google reCAPTCHA to persuade targets to run malicious commands. On Windows, the reported chain uses clipboard-delivered PowerShell, encrypted DLL loaders, and a Python bootstrap; macOS victims may receive a portable Python environment and the ransomware payload directly.
CRPx0 steals high-value data before encryption, attempts lateral movement, disables security controls, deletes backups, establishes persistence, and encrypts files with the .crpx0 extension. Victims reportedly receive 48 hours to pay before stolen data is threatened with publication. The operation uses a clearnet PHP relay to proxy communications to Tor infrastructure and claims 47 victims, mainly in the United States and Turkey. Defenders should restrict ClickFix-prone execution paths, investigate suspicious RunMRU entries and pre-encryption exfiltration, block validated network indicators, and ensure backups cannot be accessed using compromised credentials.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
CRPx0 published a v3.0 update note advertising a web-based control center for compromised systems. The advertised capabilities included file, credential, cryptocurrency recovery-phrase, and private-key theft, as well as remote command execution.
CRPx0 reportedly launched an affiliate program with a US$333 entry fee, a 70/30 revenue split favoring affiliates, Monero payment preference, and restrictions against targeting CIS countries.
CRPx0 was reported as active from June 2026, operating ransomware, cryptocurrency theft, and hacking-as-a-service offerings. Its clear-web leak site reportedly listed fewer than 10 organizations during the month.
The reporting identified the same TOX ID used by CRPX0 on flash-token.shop, a service advertising temporary synthetic cryptocurrency assets. The shared identifier was assessed as direct evidence associating CRPX0 with the Flash Token scam operation.
Ransom-ISAC published a technical analysis detailing CRPx0's ClickFix delivery chains, Python ransomware payload, pre-encryption theft, security-control evasion, persistence, backup deletion, encryption, and lateral-movement capabilities. The report also identified network, header, token, file, and persistence artifacts, while cautioning that automatically extracted IOCs require validation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 71 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourceransom-isac.org
Open sourcecyberveille.ch
Open sourcetheravenfile.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Aryaka Threat Research Labs reported a multi-stage **CRPx0** malware campaign that tricks users searching for “free OnlyFans accounts” into opening a malicious ZIP archive containing a disguised shortcut. The shortcut launches hidden commands and a VBScript loader that prepares the host, installs components for Python-based malware, and connects to a remote server for interactive attacker control. Researchers said the operation targets **Windows** and **macOS**, with possible **Linux** support in development, and is built to blend into normal user behavior rather than rely on a single obvious malicious action. Once active, the malware supports clipboard-based cryptocurrency theft, credential and data harvesting, system reconnaissance, selective exfiltration, and eventual ransomware deployment in a **double-extortion** scheme. Stolen content reportedly includes documents, media, emails, and source code before files are encrypted with the `.crpx0` extension; the malware then changes the desktop wallpaper to a “gotcha” image and drops multilingual ransom notes directing victims to contact the operators via email, **qTox**, and **Telegram**. Reporting also said the group runs a leak site claiming 38 victims and more than 10,839 TB of leaked data, while offering access to stolen information for **$500** in cryptocurrency.
Jun 29, 2026
Researchers found an open directory and management panel tied to the **CRPX0** malware operation at `fanonlyatn[.]xyz`, exposing the full source code, backend infrastructure, and operator details for a malware-as-a-service platform. The leaked materials showed a three-part criminal toolkit: a cryptocurrency clipboard hijacker supporting 10 coins, a **BIP39** seed-phrase scanner and stealer, and ransomware for **Windows, macOS, and Linux** that appends the `.crpx0` extension. The code and panel also exposed plaintext secrets, including a shared dashboard API secret, a loader password, ten hardcoded wallet addresses, and contact points linked to the operator, including the Telegram handle **@DataBreachPlus**, `databreachplus@proton[.]me`, and a qTox ID. Analysis of the leaked infrastructure tied the operation to backup command-and-control and ransom-notification domains hosted on `31[.]31[.]198[.]206` through **REG.RU**, while the primary panel sat behind Cloudflare. The exposed files showed Windows routines to delete Volume Shadow Copies, macOS builder scripts aimed at bypassing Gatekeeper, and lures themed around fake **FedEx** shipping notices and fake **OnlyFans** account lists. Researchers also identified a separate exposed **TwizAdmin** panel at `103.241.66[.]238:1337` that pointed to additional infostealer functionality and suggested the campaign has been active since at least July 2025; one unusual artifact was ransomware wallpaper containing **C2PA** metadata indicating it had been generated with **ChatGPT/GPT-4**.
Jun 29, 2026
Researchers reported multiple **ClickFix** campaigns using fake CAPTCHA or reCAPTCHA prompts to trick users into manually running malicious commands, with payloads tailored by platform and victim profile. On Windows, one campaign delivered a modular NodeJS-based RAT and infostealer through a malicious MSI installer, loading key capabilities only in memory after command-and-control was established and using `gRPC` over Tor for persistent communications. An operational security failure exposed the malware’s backend protocol definitions and admin panel API, revealing a malware-as-a-service operation with multi-operator support, Telegram alerts, automation rules, and cryptocurrency wallet tracking. The malware also fingerprinted victims extensively and established persistence through the Windows Run registry key as **LogicOptimizer**. A separate ClickFix chain attributed with high confidence to **Grandoreiro** targeted users of eight Brazilian banks by luring victims through a fake reCAPTCHA page and launching a malicious PowerShell sequence that sideloaded a Delphi banking trojan with legitimate GoToMeeting and Nero binaries. The malware deployed banking overlays, intercepted **PIX** QR-code payments, added Microsoft Defender exclusions, and stole credentials, device information, signatures, and payment confirmation codes. Netskope also documented a macOS variant that used AppleScript and a persistent fake password dialog to harvest Keychain data, browser cookies, saved credentials, extension storage, and cryptocurrency wallet data; the theft of live session cookies can enable attackers to bypass MFA by hijacking authenticated sessions.
Jun 29, 2026