Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
Fake Google and Cloudflare Verification Pages Spread Multiple Malware Families
Malware Families
Excerpt
A sprawling ClickFix campaign that abuses fake Google and Cloudflare verification pages to trick users into infecting their own machines. Documented by Malwarebytes, the operation delivers a wide range of payloads including HijackLoader, StealC, Remus, Amatera Stealer, CastleLoader, NetSupport, and a Rust-based stealer, all tied to shared infrastructure active since late 2025. ClickFix attacks don’t rely on exploits. Instead, they socially engineer victims into copying…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 0234e3188f2883a438b3f2beab7a78b2 | Medium | Score 53/100 | First seen |
| MD5 | 6a9ac6b3fff7b695dbd4df6ff7f6c516 | High | Score 86/100 | First seen |
| Domain | antibotv3.com | High | Score 58/100 | First seen |
| MD5 | 4ed7b8ecee744dea930d74ba4ac74285 | Medium | Score 53/100 | First seen |
| Domain | pub-4ed7b8ecee744dea930d74ba4ac74285.r2.dev | High | Score 58/100 | First seen |
| IP | 151.240.151.126 | Medium | Score 48/100 | First seen |
| Domain | generator-qrcode.online | High | Score 58/100 | First seen |
| MD5 | 72907d0ca3258365838626f6a8d993a6 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…