← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Crazy Evil / OBS — Crypto Fraud Network — 40+ Phishing Domains, StealC, AMOS
WHITE Crazy Evil night0xhat 2026-03-03 Modified: 2026-04-02
76
IOCs
HIGH VOLUME
Active organized cybercrime infrastructure operated by the OBS branch of "Crazy Evil" (Russian-speaking traffer team, active since 2021, $5M+ stolen). C2 dashboard at obs.casino manages 17 phishing projects across 40+ domains. Distributes StealC (Windows) and AMOS (macOS). Tools: Crazy Drainer (Solana), Ledger Loader, keylogger, AI voice generator. Ref: Recorded Future Jan 2025.
crazy evilcryptofraud networkactivethreat actormalwarestealcwindowsamoscrazy drainerinternalOBSinfostealerphishingwallet-drainercryptocurrency
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Stealc AMOS Atomic macOS Stealer
Indicators of Compromise (39 / 76 total)
All URL domain hostname
TYPEINDICATORDESCRIPTIONCREATED
URL https://huddle.joincall.now — 2026-03-03
URL https://huddle.joinmeet.now — 2026-03-03
URL https://huddle01.one — 2026-03-03
URL https://huddle01.tv — 2026-03-03
URL https://huddle01.vc — 2026-03-03
URL https://huddle04.com — 2026-03-03
URL https://huddle08.com — 2026-03-03
URL https://joinbeta.now — 2026-03-03
URL https://joincall.now — 2026-03-03
URL https://joinmeet.now — 2026-03-03
URL https://kakaoconf.com — 2026-03-03
URL https://kakaocont.com — 2026-03-03
URL https://kakaofast.com — 2026-03-03
URL https://kakaogo.com — 2026-03-03
URL https://kakaoline.com — 2026-03-03
URL https://kakaosigns.com — 2026-03-03
URL https://kakaoteam.com — 2026-03-03
URL https://line.joincall.now — 2026-03-03
URL https://line.joinmeet.now — 2026-03-03
URL https://obs.casino — 2026-03-03
URL https://signow.us — 2026-03-03
URL https://slack.cx — 2026-03-03
URL https://slack.workspace14.com — 2026-03-03
URL https://streamyard.com.co — 2026-03-03
URL https://streamyard.now — 2026-03-03
URL https://teams.joincall.now — 2026-03-03
URL https://teams.joinmeet.now — 2026-03-03
URL https://voovmeet.now — 2026-03-03
URL https://voovmeeting.org — 2026-03-03
URL https://voovmeeting.talk — 2026-03-03
URL https://waaako.net — 2026-03-03
URL https://web11eu.com — 2026-03-03
URL https://wechat.joincall.now — 2026-03-03
URL https://wechat.joinmeet.now — 2026-03-03
URL https://workspace14.com — 2026-03-03
URL https://xchat.joinbeta.now — 2026-03-03
URL https://xchatbeta.com — 2026-03-03
URL https://zoom.web11eu.com — 2026-03-03
URL https://zoom.web11eu.com/j/97772814167?pwd=voHldcR0hiQ2WnXWO1nlbaSsMj7RAbLn — 2026-03-03