Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
132 IOCs
ClickFix Campaigns Targeting Windows and macOS
Threat Actors
Malware Families
Excerpt
Executive Summary Insikt Group identified five distinct clusters leveraging the ClickFix social engineering technique to facilitate initial access to host systems. Observed since at least May 2024, these clusters include those impersonating financial application Intuit QuickBooks and the travel agency Booking.com. Insikt Group leveraged the Recorded Future® HTML Content Analysis dataset, which enables systematic monitoring of embedded web artifacts to identify and track new…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(4)
Victim
Indicators of Compromise
Open the mindmap →132 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 5d821db386c7c879caeabf3e9f94c94a48eec6ec5a3a0efbae9d69da3f52c1db | Medium | Score 53/100 | First seen |
| Domain | bebirdrank.com | High | Score 58/100 | First seen |
| Domain | quiptly.com | High | Score 58/100 | First seen |
| Domain | acconthelpdesk.com | High | Score 58/100 | First seen |
| IP | 45.144.233.192 | High | Score 58/100 | First seen |
| IP | 45.93.20.141 | High | Score 58/100 | First seen |
| Domain | shopifyservercloud.com | High | Score 58/100 | First seen |
| Domain | anthonydee.com | High | Score 58/100 | First seen |
| Domain | hostmaster.extracareliving.com | High | Score 58/100 | First seen |
| Domain | fixbirdrank.com | High | Score 58/100 | First seen |
| Domain | usbirdrank.com | High | Score 58/100 | First seen |
| Domain | bancatangcode.com | High | Score 58/100 | First seen |
| IP | 91.202.233.206 | High | Score 58/100 | First seen |
| Domain | octopox.com | High | Score 58/100 | First seen |
| Domain | 4freepics.com | High | Score 58/100 | First seen |
| Domain | extracareliving.com | High | Score 58/100 | First seen |
| Domain | topbirdrep.com | High | Score 58/100 | First seen |
| IP | 152.89.244.70 | High | Score 58/100 | First seen |
| Domain | helpbirdrep.com | High | Score 58/100 | First seen |
| Domain | cryptoinfnews.com | High | Score 58/100 | First seen |
| URL | https://alababababa.cloud/cVGvQio6.txt. | High | Score 58/100 | First seen |
| Domain | mac-os-helper.com | High | Score 58/100 | First seen |
| Domain | mybirdrank.com | High | Score 58/100 | First seen |
| Domain | macapp-apple.com | High | Score 58/100 | First seen |
| Domain | checkpulse.com | High | Score 58/100 | First seen |
| Domain | valetfortesla.com | High | Score 58/100 | First seen |
| Domain | suedfactoring.it.com | High | Score 58/100 | First seen |
| Domain | traderslinkfx.com | High | Score 58/100 | First seen |
| Domain | macosxapp.com | High | Score 58/100 | First seen |
| Domain | usebirdrep.com | High | Score 58/100 | First seen |
| Domain | birdrepbiz.com | High | Score 58/100 | First seen |
| Domain | optbirdrank.com | High | Score 58/100 | First seen |
| Domain | cryptonews-info.com | High | Score 58/100 | First seen |
| Domain | guypinions.com | High | Score 58/100 | First seen |
| Domain | gobirdrank.com | High | Score 58/100 | First seen |
| Domain | account-help.info | High | Score 58/100 | First seen |
| Domain | birdrankfx.com | High | Score 58/100 | First seen |
| Domain | birdrankusa.com | High | Score 58/100 | First seen |
| Domain | getbirdrank.com | High | Score 58/100 | First seen |
| IP | 193.58.122.97 | High | Score 58/100 | First seen |
| Domain | sign-in-op-token.com | High | Score 58/100 | First seen |
| SHA256 | c0af6e9d848ada3839811bf33eeb982e6c207e4c40010418e0185283cd5cff50 | Medium | Score 53/100 | First seen |
| Domain | ustazazharidrus.com | High | Score 58/100 | First seen |
| Domain | macosxappstore.com | High | Score 58/100 | First seen |
| Domain | appmacintosh.com | High | Score 58/100 | First seen |
| IP | 193.35.17.12 | High | Score 58/100 | First seen |
| Domain | nowbirdrank.com | High | Score 58/100 | First seen |
| Domain | birdreplab.com | High | Score 58/100 | First seen |
| Domain | thepulseactivity.com | High | Score 58/100 | First seen |
| Domain | appsmacosx.com | High | Score 58/100 | First seen |
| Domain | birdrankinc.com | High | Score 58/100 | First seen |
| Domain | account-helpdesk.icu | High | Score 58/100 | First seen |
| Domain | appmacosx.com | High | Score 58/100 | First seen |
| Domain | macosx-apps.com | High | Score 58/100 | First seen |
| Domain | deinhealthcoach.com | High | Score 58/100 | First seen |
| Domain | accountpulse.help | High | Score 58/100 | First seen |
| IP | 193.222.99.212 | High | Score 58/100 | First seen |
| IP | 62.164.177.230 | High | Score 58/100 | First seen |
| Domain | birdrankzen.com | High | Score 58/100 | First seen |
| Domain | cryptoinfo-allnews.com | High | Score 58/100 | First seen |
| Domain | theinvestworthy.com | High | Score 58/100 | First seen |
| Domain | ms-scedg.com | High | Score 58/100 | First seen |
| Domain | mrinmay.net | High | Score 58/100 | First seen |
| Domain | gologpoint.com | High | Score 58/100 | First seen |
| Domain | admin-activitycheck.com | High | Score 58/100 | First seen |
| Domain | justbirdrank.com | High | Score 58/100 | First seen |
| Domain | customblindinstall.com | High | Score 58/100 | First seen |
| Domain | topbirdrank.com | High | Score 58/100 | First seen |
| Domain | birdrepgo.com | High | Score 58/100 | First seen |
| Domain | chrm-srv.com | High | Score 58/100 | First seen |
| Domain | vipbirdrank.com | High | Score 58/100 | First seen |
| Domain | surecomforts.com | High | Score 58/100 | First seen |
| Domain | macapps-apple.com | High | Score 58/100 | First seen |
| Domain | birdrankus.com | High | Score 58/100 | First seen |
| Domain | financementure.com | High | Score 58/100 | First seen |
| Domain | checkaccountactivity.com | High | Score 58/100 | First seen |
| SHA256 | 43907e54cf3d1258f695d1112759b5457576481072cc76a679b8477cfeb3db87 | Medium | Score 53/100 | First seen |
| IP | 94.156.112.115 | High | Score 58/100 | First seen |
| Domain | nobovcs.com | High | Score 58/100 | First seen |
| Domain | yvngvualr.com | High | Score 58/100 | First seen |
| Domain | acebirdrep.com | High | Score 58/100 | First seen |
| IP | 77.91.65.31 | High | Score 58/100 | First seen |
| Domain | bitbirdrep.com | High | Score 58/100 | First seen |
| Domain | helpdeskpulse.com | High | Score 58/100 | First seen |
| Domain | macosx-app.com | High | Score 58/100 | First seen |
| Domain | birdrepsys.com | High | Score 58/100 | First seen |
| IP | 77.91.65.144 | High | Score 58/100 | First seen |
| Domain | fomomforhealth.com | High | Score 58/100 | First seen |
| Domain | hotelupdatesys.com | High | Score 58/100 | First seen |
| Domain | birdrankup.com | High | Score 58/100 | First seen |
| Domain | billiardinstitute.com | High | Score 58/100 | First seen |
| Domain | grandmastertraders.traderslinkfx.com | High | Score 58/100 | First seen |
| Domain | birdrankbox.com | High | Score 58/100 | First seen |
| Domain | helpbirdrank.com | High | Score 58/100 | First seen |
| Domain | ned.coveney-ltd.com | High | Score 58/100 | First seen |
| Domain | macxapp.com | High | Score 58/100 | First seen |
| Domain | visitbundala.com | High | Score 58/100 | First seen |
| Domain | apposx.com | High | Score 58/100 | First seen |
| SHA256 | b17c3e4058aacdcc36b18858d128d6b3058e0ea607a4dc59eb95b18b7c6acc7c | Medium | Score 53/100 | First seen |
| Domain | elive777a.com | High | Score 58/100 | First seen |
| Domain | orkneygateway.com | High | Score 58/100 | First seen |
| Domain | birdrepusa.com | High | Score 58/100 | First seen |
| Domain | ariciversontile.com | High | Score 58/100 | First seen |
| Domain | pulse-help-desk.com | High | Score 58/100 | First seen |
| Domain | nhacaired88.com | High | Score 58/100 | First seen |
| SHA256 | 397dcea810f733494dbe307c91286d08f87f64aebbee787706fe6561ed3e20f8 | Medium | Score 53/100 | First seen |
| Domain | birdrephelp.com | High | Score 58/100 | First seen |
| Domain | account-helpdesk.top | High | Score 58/100 | First seen |
| Domain | bkng-updt.com | High | Score 58/100 | First seen |
| Domain | macxapp.org | High | Score 58/100 | First seen |
| Domain | bitbirdrank.com | High | Score 58/100 | First seen |
| IP | 87.236.16.20 | High | Score 58/100 | First seen |
| Domain | account-helpdesk.info | High | Score 58/100 | First seen |
| Domain | appxmacos.com | High | Score 58/100 | First seen |
| Domain | birdrankvip.com | High | Score 58/100 | First seen |
| Domain | macosapp-apple.com | High | Score 58/100 | First seen |
| Domain | accountmime.com | High | Score 58/100 | First seen |
| Domain | birdrankllc.com | High | Score 58/100 | First seen |
| Domain | infobirdrep.com | High | Score 58/100 | First seen |
| Domain | joeyapple.com | High | Score 58/100 | First seen |
| Domain | checkpulses.com | High | Score 58/100 | First seen |
| Domain | birdrepuse.com | High | Score 58/100 | First seen |
| Domain | birdranktip.com | High | Score 58/100 | First seen |
| Domain | birdrankgo.com | High | Score 58/100 | First seen |
| Domain | probirdrep.com | High | Score 58/100 | First seen |
| IP | 45.93.20.50 | High | Score 58/100 | First seen |
| Domain | checkhelpdesk.com | High | Score 58/100 | First seen |
| Domain | cryptoinfo-news.com | High | Score 58/100 | First seen |
| Domain | birdrankmax.com | High | Score 58/100 | First seen |
| Domain | elive123go.com | High | Score 58/100 | First seen |
| Domain | thestayreserve.com | High | Score 58/100 | First seen |
| Domain | subsgod.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…