Elektrine
EN
Log in Register
Paige Chat Timeline Communities Gallery Videos Email DNS VPN Uptime Kairo
Back to Timeline
Remote

Monitor SG

@monitorsg@infosec.exchange
  • Open on infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG.

Samples and IOCs sent to MalwareBazaar and ThreatFox.

0 Followers
0 Following
50 Posts
Joined June 12, 2023
MalwareBazaar:
https://bazaar.abuse.ch/user/10197/
ThreatFox:
https://threatfox.abuse.ch/user/5719/

Posts

Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · 5d ago
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
New #SocGholish C2: hXXps://ui-portal.mekebibsolomonlaw[.]com/Xgd37BKqtSdK7BK3ECMfuoWjHCdMu3bB1ol3tSdD7BKqkw== ui-portal.mekebibsolomonlaw[.]com 104[.]238.57.228 AS199959 GWY IT PTY LTD
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Aug 03, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> mezcalpro[.]com/scq (injected) --> slatebeacon[.]top/legacy/throttle-theme.js --> slatebeacon[.]top/legacy/identity-build --> slatebeacon[.]top/legacy/version-validator.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 30, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
New #SocGholish C2: hXXps://js.galmabuna[.]com/Xgd37BKqtSdK7BK3icTOHNEMiIdfEhmPicqMXSbB1ol3tSdD7BKqkw== js.galmabuna[.]com 45[.]61.150.158 AS14956 RouterHosting LLC
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 30, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> namastheandhra[.]com/cloudflare (injected) --> chestnutstanza[.]top/realm/oauth-pipeline.js --> chestnutstanza[.]top/realm/health-service --> chestnutstanza[.]top/realm/acl-controller.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 29, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> ibharcan[.]com/meta.google.com (injected) --> mulberrylodestar[.]top/metrics/verify-client.js --> mulberrylodestar[.]top/metrics/api-transpiler --> mulberrylodestar[.]top/metrics/signin-fetch.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 29, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> griffihhs[.]click/q2hfsow4.js (ClickFucker) --> griffihhs[.]click/api/v1/session (token) --> griffihhs[.]click/api/v1/verify (gateway) --> griffihhs[.]click/api/v1/status (clipboard) --> tom-yy[.]top/f (powershell) 24d35d5da1d2f76292de0c6bc406fcc1108055eaaa0b54952cf8d9a49d0aea3e f
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 28, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> kblaa[.]com/gfont.ttf (injected) --> novacupola[.]top/role/logout-header.js --> novacupola[.]top/role/handler-deploy --> novacupola[.]top/role/rate-layout.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 28, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
New #SocGholish C2: hXXps://js-dl.kaliesthenics[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== js-dl.kaliesthenics[.]com 144[.]172.105.121 AS14956 RouterHosting LLC
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 28, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> phiplips[.]click/l1hdpx7b.js (ClickFucker) --> phiplips[.]click/api/v1/session (token) --> phiplips[.]click/api/v1/verify (gateway) --> phiplips[.]click/api/v1/status (clipboard) --> tommy-eg[.]top/f (powershell) 372fa1524bcf4bb658b87d830071be38826beafb3311cd73c3d0314433233a5c f
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 27, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> mezcalpro[.]com/scq (injected) --> acaciaearthwork[.]top/private/session-util.js --> acaciaearthwork[.]top/private/login-dom --> acaciaearthwork[.]top/private/health-header.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 27, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> chaphan[.]click/jkg4oml2.js (ClickFucker) --> chaphan[.]click/api/v1/session (token) --> chaphan[.]click/api/v1/verify (gateway) --> chaphan[.]click/api/v1/status (clipboard) --> tommy-er[.]top/f (powershell) 61351d869940b9875400bf4ebd1bdc29f972813473a823acc85db242487212bc f
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 27, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
New #SocGholish C2: hXXps://app-api.starfoodmart[.]net/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== app-api.starfoodmart[.]net 45[.]32.193.249 AS20473 The Constant Company, LLC
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 27, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> kblaa[.]com/gfont.ttf (injected) --> acaciaearthwork[.]top/private/session-util.js --> acaciaearthwork[.]top/private/login-dom --> acaciaearthwork[.]top/private/health-header.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 27, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> bauabach[.]lol/zcfo2l6c.js (ClickFucker) --> bauabach[.]lol/api/v1/session (token) --> bauabach[.]lol/api/v1/verify (gateway) --> bauabach[.]lol/api/v1/status (clipboard) --> globalupdate6711[.]com/update/package (tar) c5a3d94cb6b4be539b68401e2fbd8008740d230109ee13a5b3b863f8e2d935c1 package
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 24, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> marshalh[.]icu/c9lg2uqb.js (ClickFucker) --> marshalh[.]icu/api/v1/session (token) --> marshalh[.]icu/api/v1/verify (gateway) --> marshalh[.]icu/api/v1/status (clipboard) --> hosthex9101[.]com/update/package (tar) 1cec90906b40fa7e29f0cd531d3bbcfc19f6e03fd99b5c41b5dbce8270652460 package
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 24, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> bouoher[.]lol/jyuf6cei.js (ClickFucker) --> bouoher[.]lol/api/v1/session (token) --> bouoher[.]lol/api/v1/verify (gateway) --> bouoher[.]lol/api/v1/status (clipboard) --> tommy-ee[.]top/f (powershell) bd15d8e2239a293d77a7fc1e9b38c3461c79069273d7d7c17ae1e7ca4ab82156 f
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 23, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> barringer[.]click/dsdchzzv.js (ClickFucker) --> barringer[.]click/api/v1/session (token) --> barringer[.]click/api/v1/verify (gateway) --> barringer[.]click/api/v1/status (clipboard) --> tommy-bb[.]lol/f (powershell) 489f30e58a4bd38d0707c7123967c8d62c35f80c0393f5d05d4c7ba3b12ae22d f
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 23, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
New #SocGholish C2: hXXps://api-store.urgaacoffeeroastery[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== api-store.urgaacoffeeroastery[.]com 89[.]117.0.122 AS46475 Limestone Networks, Inc.
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 22, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
New #SocGholish C2: hXXps://prod-dl.vandornpharmacy[.]net/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== prod-dl.vandornpharmacy[.]net 91[.]236.230.188 AS62005 BlueVPS OU
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 21, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> kblaa[.]com/gfont.ttf (injected) --> nebulaloom[.]top/oauth/reset-dom.js --> nebulaloom[.]top/oauth/auth-server --> nebulaloom[.]top/oauth/gateway-html.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 21, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
New #SocGholish C2: hXXps://cdn-js.tobaccobazaar[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== cdn-js.tobaccobazaar[.]com 89[.]117.0.38 AS46475 Limestone Networks, Inc.
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 20, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
New #SocGholish C2: hXXps://img2.mekebibsolomonlaw[.]com/Xgd37BKqtSdK7BK3EoPIivP5ygbB1ol3tSdD7BKqkw== img2.mekebibsolomonlaw[.]com 108[.]61.194.248 AS20473 The Constant Company, LLC
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 20, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> meduurst[.]space/vtyzese3.js (ClickFucker) --> meduurst[.]space/api/v1/session (token) --> meduurst[.]space/api/v1/verify (gateway) --> meduurst[.]space/api/v1/status (clipboard) --> nodemetrics9095[.]com/update/package (tar) a1e14e2b06dc859053cb63cfa9e76b4ef43540a35d736dc9fb1c39986bf67654 package
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 17, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> oosterhout[.]click/82234daz.js (ClickFucker) --> oosterhout[.]click/api/v1/session (token) --> oosterhout[.]click/api/v1/verify (gateway) --> oosterhout[.]click/api/v1/status (clipboard) --> tommy-aa[.]lol/f (powershell) 64242dabcf2551d3aeab1ce9e22ae2e8508726d20ec3b347f783e5fa7216423c f
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 17, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
New #SocGholish C2: hXXps://up-to-date.paquetesparaorlando[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== up-to-date.paquetesparaorlando[.]com 216[.]128.153.117 AS20473 The Constant Company, LLC
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 17, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> kblaa[.]com/gfont.ttf (injected) --> amberobservatory[.]top/public/scope-cookie.js --> amberobservatory[.]top/public/middleware-sessionstore --> amberobservatory[.]top/public/callback-asset.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 16, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
New #SocGholish C2: hXXps://img-eu.veranofund[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== img-eu.veranofund[.]com 137[.]220.49.12 AS20473 The Constant Company, LLC
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 15, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/meta.google.com (injected) --> granitehearth[.]top/status/profile-runtime.js --> granitehearth[.]top/status/status-parser --> granitehearth[.]top/status/health-effect.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 15, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
New #SocGholish C2: hXXps://free-api.travelaccex[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== free-api.travelaccex[.]com 45[.]76.238.138 AS20473 The Constant Company, LLC
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 15, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> ritchie[.]click/frxhgs71.js (ClickFucker) --> ritchie[.]click/api/v1/session (token) --> ritchie[.]click/api/v1/verify (gateway) --> ritchie[.]click/api/v1/status (clipboard)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 15, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> ritchie[.]click/ksbfgehn.js (ClickFucker) --> ritchie[.]click/api/v1/session (token) --> ritchie[.]click/api/v1/verify (gateway) --> ritchie[.]click/api/v1/status (clipboard) --> f-codebase[.]lol/f (powershell) a6846acd9c5b16a128b68f45f9af8ce2c9e10fa73a390c53e8b4546862a14222 f
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 15, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> ritchie[.]click/bgmmbr3x.js (ClickFucker) --> ritchie[.]click/api/v1/session (token) --> ritchie[.]click/api/v1/verify (gateway) --> ritchie[.]click/api/v1/status (clipboard)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 14, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/meta.google.com (injected) --> alabastercompass[.]top/public/callback-stylesheet.js --> alabastercompass[.]top/public/refresh-cookie --> alabastercompass[.]top/public/throttle-sandbox.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 14, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> alabastercompass[.]top/public/refresh-cookie --> alabastercompass[.]top/public/throttle-sandbox.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 14, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> hazelcitadel[.]top/public/refresh-cookie --> hazelcitadel[.]top/public/throttle-sandbox.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 14, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/q (injected) --> alabastercompass[.]top/public/refresh-cookie --> alabastercompass[.]top/public/throttle-sandbox.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 13, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> moonlitprovince[.]top/router/verify-build --> moonlitprovince[.]top/router/handler-asset.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 13, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/q (injected) --> jadeworkshop[.]top/router/verify-build --> jadeworkshop[.]top/router/handler-asset.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 10, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> silverlandscape[.]top/claims/profile-view --> silverlandscape[.]top/claims/identity-render.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 10, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> thibahlt[.]lol/file.js (ClickFucker) --> thibahlt[.]lol/api/v1/session (token) --> thibahlt[.]lol/api/v1/verify (gateway) --> thibahlt[.]lol/api/v1/status (clipboard)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 10, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
New #SocGholish C2: hXXps://drive4.destinationgallery[.]com/Xgd37BKqtSdK7BK3uIzjYIr5uSbB1ol3tSdD7BKqkw== drive4.destinationgallery[.]com 104[.]200.73.216 AS199959 GWY IT PTY LTD
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 10, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> marblehaven[.]top/claims/profile-view --> marblehaven[.]top/claims/identity-render.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 10, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/q (injected) --> marblehaven[.]top/claims/profile-view --> marblehaven[.]top/claims/identity-render.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 10, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> mezcalpro[.]com/scq (injected) --> silverlandscape[.]top/claims/refresh-cookie.js --> silverlandscape[.]top/claims/profile-view --> silverlandscape[.]top/claims/identity-render.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 09, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> henreques[.]lol/file.js (ClickFucker) --> henreques[.]lol/api/v1/session (token) --> henreques[.]lol/api/v1/verify (gateway) --> henreques[.]lol/api/v1/status (clipboard)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 09, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/d.js (injected) --> linenregistry[.]top/route/health-json.js --> linenregistry[.]top/route/callback-deploy --> linenregistry[.]top/route/profile-xml.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 09, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> henreques[.]lol/file.js (ClickFucker) --> henreques[.]lol/api/v1/session (token) --> henreques[.]lol/api/v1/verify (gateway) --> henreques[.]lol/api/v1/status (clipboard) --> cloudpass7138[.]lol/update/package (tar) a83f4d0056f8008633e1531c5f85abe683920445a085db486222f673dc90544a package
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 09, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> carreiro[.]lol/file.js (ClickFucker) --> carreiro[.]lol/api/v1/session (token) --> carreiro[.]lol/api/v1/verify (gateway) --> carreiro[.]lol/api/v1/status (clipboard)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 09, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #SmartApeSG infection chain Compromised site --> cpajoliette[.]com/q (injected) --> linenregistry[.]top/route/callback-deploy --> linenregistry[.]top/route/profile-xml.js (clickfix)
0
0
0
0
Open post
monitorsg
Monitor SG @monitorsg@infosec.exchange · Jul 08, 2026
Monitor SG
@monitorsg@infosec.exchange

Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG. Samples and IOCs sent to MalwareBazaar and ThreatFox.

infosec.exchange
Detected #KongTuke infection chain Compromised site --> fraitas[.]lol/file.js (ClickFucker) --> fraitas[.]lol/api/v1/session (token) --> fraitas[.]lol/api/v1/verify (gateway) --> fraitas[.]lol/api/v1/status (clipboard) --> tommy-q[.]lol/o (powershell) ab0cb56912b87e6baf56ccced556f726d988c432561e94d671a15e891bb7d9df o
0
0
0
0

Remote instance

infosec.exchange
Open on original server
313k7r1n3
Elektrine

Tor hidden service

elekhj7afj4qnrr4yd3bkzslsyo5jgfxw3orgjkhlcxifueodybyiiad.onion

Platform

  • Email
  • Chat
  • Timeline
  • Communities
  • VPN
  • DNS

Company

  • About
  • Contact
  • FAQ

Legal

  • Terms of Service
  • Privacy Policy
  • Warrant Canary
  • Lite (no JS)
  • VPN Policy
  • Source code

Support

  • support@elektrine.com
  • Report Security Issue
Mail client setup IMAP mail.elektrine.com:993 POP3 mail.elektrine.com:995 SMTP mail.elektrine.com:465
© 2026 Elektrine. All rights reserved. Server: 23:43:21 UTC