Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Cybercriminals Impersonate Claude Code to Deploy Fileless .NET Infostealer
Excerpt
Cybercriminals are actively exploiting the growing popularity of AI development tools by using SEO poisoning to target new users of Anthropic’s Claude Code. Security researchers at Howler Cell have uncovered a sophisticated campaign that directs eager, non-technical builders to fake installation pages. These spoofed pages use a social engineering technique known as ClickFix, which tricks users into pasting a malicious command into the Windows Run dialog (Win+R). Because…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | download.version-516.com | High | Score 58/100 | First seen |
| Domain | oakenfjrod.ru | High | Score 61/100 | First seen |
| IP | 185.177.239.255 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…