Detected #SmartApeSG infection chain
Compromised site
-->
mezcalpro[.]com/scq (injected)
-->
tamarackhenge[.]org/proxy/acl-parser.js
-->
tamarackhenge[.]org/proxy/api-cookie
-->
tamarackhenge[.]org/proxy/signin-controller.js (clickfix)
XFEDI
ActivityPubRemote profile
Monitor SG
Experimental automated monitoring of #SocGholish, #FakeSG, #ClearFake, #ClickFix, #KongTuke, #ParrotTDS and #SmartApeSG.
Samples and IOCs sent to MalwareBazaar and ThreatFox.
Posts
Detected #SmartApeSG infection chain
Compromised site
-->
mezcalpro[.]com/scq (injected)
-->
baritepantheon[.]info/signin/private-pipeline.js
-->
baritepantheon[.]info/signin/identity-deploy
-->
baritepantheon[.]info/signin/callback-state.js (clickfix)
New #SocGholish C2:
hXXps://player-js.joelbauer[.]com/
player-js.joelbauer[.]com
185[.]28.119.98
AS62005 BlueVPS OU
New #SocGholish C2:
hXXps://ssp-prod.joelbauertraining[.]com/
ssp-prod.joelbauertraining[.]com
149[.]28.94.211
AS20473 The Constant Company, LLC