Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
PolinRider is A/B Testing its Way Past Your Detections
Malware Families
Excerpt
PolinRider is A/B Testing its Way Past Your Detections | OpenSourceMalware BLOG PolinRider is A/B Testing its Way Past Your Detections We've seen fa-solid-400.woff2 become 500 and 900, change from .woff2 to .llf files, move folders, and drop its whitespace padding. By cb482791-4ef1-4762-96ad-b0ca4bdd538e · 2026-09-26T08:06:00.000Z Update, September 28: Two days after publishing, we saw the payload renamed again, to fa-solid-300.llf , which isn't a font extension at…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://260120.vercel.app/settings/linux?flag=9-test | High | Score 58/100 | First seen |
| SHA256 | fbf0e36dd7eb1e70fc4868a8d0d0cd8f6c80753241cd88a3518f40e9a67d232e | Medium | Score 53/100 | First seen |
| SHA256 | 1a21bad1df69b51efebfd2fae849ac27722b0dfac7b1cb459cf81d38b36f9705 | Medium | Score 53/100 | First seen |
| SHA1 | dc6992e9de01ddae4cada05fec24ac7010f40367 | Medium | Score 53/100 | First seen |
| SHA256 | 91e334655d31f84963e6b9369d41698f51b00d7a203cf314ceba01780e6f337c | Medium | Score 53/100 | First seen |
| URL | https://260120.vercel.app/settings/win?flag=9-test | High | Score 58/100 | First seen |
| SHA256 | 90a3875ff84a53473107a03cec6ad19636da0cc0eccb02c036d03b8f2a5dff28 | Medium | Score 53/100 | First seen |
| SHA256 | 6200054e0ea8575c3af37e4da10e23249bf0a17d1d6843ecc81ee35af2f7d1f2 | Medium | Score 53/100 | First seen |
| SHA256 | 3b572a613f5013a64e1877dfed3873f2bcbd52e5259b199d41e02c33840abbcb | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…