Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Hackers Use Fake Cloudflare CAPTCHA and BSOD Lures to Deliver SmartRAT Malware
Excerpt
Cybersecurity researchers have uncovered a new malware campaign using AI-generated websites to trick users into downloading a dangerous remote access Trojan (RAT). Discovered by Zscaler ThreatLabz in March 2026, the campaign targets customers of a major Brazilian bank using a deceptive technique known as ClickFix. By displaying a fake Cloudflare CAPTCHA and a simulated Blue Screen of Death (BSOD), hackers pressure victims into running malicious PowerShell commands. The…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | crefisa.online | High | Score 72/100 | First seen |
| Domain | vfsgloball.net | High | Score 72/100 | First seen |
| Domain | cartaobb.com | High | Score 73/100 | First seen |
IOC Relationship Graph
Building graph…