Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing…
Threat Actors
Excerpt
Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing Malware Abstract On July 8, 2026, Bruce Xu (@brucexu_eth) reported a phishing link disguised as a BuilDAO / Builder community application page. The attackers hosted the page on Google Sites, leveraging the trusted appearance of sites.google.com to lower users’ guard. The first part of the page mimicked a community application form, prompting users to provide information such as…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://86.54.25.213/log | High | Score 86/100 | First seen |
| MD5 | 7ca94f9fa3eb4164ba7e5d41623a458a | Medium | Score 53/100 | First seen |
| URL | http://86.54.25.213/d/unix32385485 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…