PULSE NAME
Crazy Evil / OBS — Crypto Fraud Network — 40+ Phishing Domains, StealC, AMOS
WHITE Crazy Evil night0xhat 2026-03-03 Modified: 2026-04-02
76
IOCs
HIGH VOLUME
Active organized cybercrime infrastructure operated by the OBS branch of "Crazy Evil" (Russian-speaking traffer team, active since 2021, $5M+ stolen). C2 dashboard at obs.casino manages 17 phishing projects across 40+ domains. Distributes StealC (Windows) and AMOS (macOS). Tools: Crazy Drainer (Solana), Ledger Loader, keylogger, AI voice generator. Ref: Recorded Future Jan 2025.
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Stealc AMOS Atomic macOS Stealer
Indicators of Compromise (76)
All URL domain hostname
TYPEINDICATORDESCRIPTIONCREATED
URL https://huddle.joincall.now 2026-03-03
URL https://huddle.joinmeet.now 2026-03-03
URL https://huddle01.one 2026-03-03
URL https://huddle01.tv 2026-03-03
URL https://huddle01.vc 2026-03-03
URL https://huddle04.com 2026-03-03
URL https://huddle08.com 2026-03-03
URL https://joinbeta.now 2026-03-03
URL https://joincall.now 2026-03-03
URL https://joinmeet.now 2026-03-03
URL https://kakaoconf.com 2026-03-03
URL https://kakaocont.com 2026-03-03
URL https://kakaofast.com 2026-03-03
URL https://kakaogo.com 2026-03-03
URL https://kakaoline.com 2026-03-03
URL https://kakaosigns.com 2026-03-03
URL https://kakaoteam.com 2026-03-03
URL https://line.joincall.now 2026-03-03
URL https://line.joinmeet.now 2026-03-03
URL https://obs.casino 2026-03-03
URL https://signow.us 2026-03-03
URL https://slack.cx 2026-03-03
URL https://slack.workspace14.com 2026-03-03
URL https://streamyard.com.co 2026-03-03
URL https://streamyard.now 2026-03-03
URL https://teams.joincall.now 2026-03-03
URL https://teams.joinmeet.now 2026-03-03
URL https://voovmeet.now 2026-03-03
URL https://voovmeeting.org 2026-03-03
URL https://voovmeeting.talk 2026-03-03
URL https://waaako.net 2026-03-03
URL https://web11eu.com 2026-03-03
URL https://wechat.joincall.now 2026-03-03
URL https://wechat.joinmeet.now 2026-03-03
URL https://workspace14.com 2026-03-03
URL https://xchat.joinbeta.now 2026-03-03
URL https://xchatbeta.com 2026-03-03
URL https://zoom.web11eu.com 2026-03-03
URL https://zoom.web11eu.com/j/97772814167?pwd=voHldcR0hiQ2WnXWO1nlbaSsMj7RAbLn 2026-03-03
domain huddle01.one 2026-03-03
domain huddle01.tv 2026-03-03
domain huddle01.vc 2026-03-03
domain huddle04.com 2026-03-03
domain huddle08.com 2026-03-03
domain joinbeta.now 2026-03-03
domain joincall.now 2026-03-03
domain joinmeet.now 2026-03-03
domain kakaoconf.com 2026-03-03
domain kakaocont.com 2026-03-03
domain kakaofast.com 2026-03-03
domain kakaogo.com 2026-03-03
domain kakaoline.com 2026-03-03
domain kakaosigns.com 2026-03-03
domain kakaoteam.com 2026-03-03
domain signow.us 2026-03-03
domain slack.cx 2026-03-03
domain streamyard.com.co 2026-03-03
domain streamyard.now 2026-03-03
domain voovmeet.now 2026-03-03
domain voovmeeting.org 2026-03-03
domain voovmeeting.talk 2026-03-03
domain waaako.net 2026-03-03
domain web11eu.com 2026-03-03
domain workspace14.com 2026-03-03
domain xchatbeta.com 2026-03-03
hostname huddle.joincall.now 2026-03-03
hostname huddle.joinmeet.now 2026-03-03
hostname line.joincall.now 2026-03-03
hostname line.joinmeet.now 2026-03-03
hostname slack.workspace14.com 2026-03-03
hostname teams.joincall.now 2026-03-03
hostname teams.joinmeet.now 2026-03-03
hostname wechat.joincall.now 2026-03-03
hostname wechat.joinmeet.now 2026-03-03
hostname xchat.joinbeta.now 2026-03-03
hostname zoom.web11eu.com 2026-03-03