{
  "type": "Domain",
  "indicator": "burstofclass.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/burstofclass.com",
    "alexa": "http://www.alexa.com/siteinfo/burstofclass.com",
    "indicator": "burstofclass.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3823512962,
      "indicator": "burstofclass.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6a0d971608b49dfc89267777",
          "name": "The Evolution of ClickFix: From Cleartext to Server Side Polymorphism",
          "description": "The ClickFix campaign has evolved from basic disk-based infections to sophisticated, obfuscated attacks using fake CAPTCHA pages that trick victims into executing malicious PowerShell commands. Initial variants used cleartext commands downloading batch scripts to deploy DeerStealer InfoStealer. The campaign advanced to fileless execution using XOR encryption or Base64 compression, operating entirely in memory. The most dangerous evolution involves server-side polymorphism, where attacker infrastructure dynamically generates unique obfuscated payloads for each victim, delivering Vidar InfoStealer. Active since March 2026 with surging activity through May, the campaign utilizes approximately 4,500 live domains. Both XOR and Base64 variants execute payloads in memory, download executables from attacker infrastructure, and delete traces to evade forensics.",
          "modified": "2026-05-21T16:10:15.685000",
          "created": "2026-05-20T11:12:22.964000",
          "tags": [
            "ClickFix",
            "server-side polymorphism",
            "fake CAPTCHA",
            "PowerShell",
            "DeerStealer",
            "Vidar",
            "InfoStealer",
            "fileless execution",
            "XOR encryption",
            "Base64 obfuscation"
          ],
          "references": [
            "https://www.menlosecurity.com/blog/the-evolution-of-clickfix-from-cleartext-to-server-side-polymorphism"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "DeerStealer",
              "display_name": "DeerStealer",
              "target": null
            },
            {
              "id": "Vidar",
              "display_name": "Vidar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1204.001",
              "name": "Malicious Link",
              "display_name": "T1204.001 - Malicious Link"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1059.001",
              "name": "PowerShell",
              "display_name": "T1059.001 - PowerShell"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1070.004",
              "name": "File Deletion",
              "display_name": "T1070.004 - File Deletion"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1555.003",
              "name": "Credentials from Web Browsers",
              "display_name": "T1555.003 - Credentials from Web Browsers"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1027.002",
              "name": "Software Packing",
              "display_name": "T1027.002 - Software Packing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3563,
            "IPv4": 3,
            "hostname": 936
          },
          "indicator_count": 4502,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386547,
          "modified_text": "10 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a12a215bd176163aa2b5bcc",
          "name": "The Evolution of ClickFix: From Cleartext to Server Side Polymorphism",
          "description": "",
          "modified": "2026-05-24T07:00:37.704000",
          "created": "2026-05-24T07:00:37.704000",
          "tags": [
            "ClickFix",
            "server-side polymorphism",
            "fake CAPTCHA",
            "PowerShell",
            "DeerStealer",
            "Vidar",
            "InfoStealer",
            "fileless execution",
            "XOR encryption",
            "Base64 obfuscation"
          ],
          "references": [
            "https://www.menlosecurity.com/blog/the-evolution-of-clickfix-from-cleartext-to-server-side-polymorphism"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "DeerStealer",
              "display_name": "DeerStealer",
              "target": null
            },
            {
              "id": "Vidar",
              "display_name": "Vidar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1204.001",
              "name": "Malicious Link",
              "display_name": "T1204.001 - Malicious Link"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1059.001",
              "name": "PowerShell",
              "display_name": "T1059.001 - PowerShell"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1070.004",
              "name": "File Deletion",
              "display_name": "T1070.004 - File Deletion"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1555.003",
              "name": "Credentials from Web Browsers",
              "display_name": "T1555.003 - Credentials from Web Browsers"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1027.002",
              "name": "Software Packing",
              "display_name": "T1027.002 - Software Packing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6a1283eeea5b0c771537ec61",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Tr1sa111",
            "id": "192483",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3563,
            "IPv4": 3,
            "hostname": 936
          },
          "indicator_count": 4502,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 278,
          "modified_text": "7 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a1283eeea5b0c771537ec61",
          "name": "The Evolution of ClickFix: From Cleartext to Server Side Polymorphism",
          "description": "",
          "modified": "2026-05-24T04:51:58.732000",
          "created": "2026-05-24T04:51:58.732000",
          "tags": [
            "ClickFix",
            "server-side polymorphism",
            "fake CAPTCHA",
            "PowerShell",
            "DeerStealer",
            "Vidar",
            "InfoStealer",
            "fileless execution",
            "XOR encryption",
            "Base64 obfuscation"
          ],
          "references": [
            "https://www.menlosecurity.com/blog/the-evolution-of-clickfix-from-cleartext-to-server-side-polymorphism"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "DeerStealer",
              "display_name": "DeerStealer",
              "target": null
            },
            {
              "id": "Vidar",
              "display_name": "Vidar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1204.001",
              "name": "Malicious Link",
              "display_name": "T1204.001 - Malicious Link"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1059.001",
              "name": "PowerShell",
              "display_name": "T1059.001 - PowerShell"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1070.004",
              "name": "File Deletion",
              "display_name": "T1070.004 - File Deletion"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1555.003",
              "name": "Credentials from Web Browsers",
              "display_name": "T1555.003 - Credentials from Web Browsers"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1027.002",
              "name": "Software Packing",
              "display_name": "T1027.002 - Software Packing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6a0d971608b49dfc89267777",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Tr1sa111",
            "id": "192483",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3563,
            "IPv4": 3,
            "hostname": 936
          },
          "indicator_count": 4502,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 278,
          "modified_text": "7 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a4885e735b9e8ba94805bc",
          "name": "Apple | Worm:Win32/Benjamin | thebrotherssabey.com",
          "description": "",
          "modified": "2024-09-05T06:51:42.608000",
          "created": "2024-01-15T01:20:30.730000",
          "tags": [
            "execution",
            "whois record",
            "contacted",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "copy",
            "historical ssl",
            "referrer",
            "urls url",
            "icmp",
            "malicious",
            "installer",
            "problems",
            "collections",
            "report",
            "phishing",
            "service tool",
            "greatness",
            "threat network",
            "emotet",
            "magniber",
            "startpage",
            "attack",
            "banker",
            "keylogger",
            "namecheap inc",
            "com laude",
            "ltd dba",
            "cloudflare",
            "porkbun llc",
            "ii llc",
            "csc corporate",
            "domains",
            "computer",
            "company limited",
            "first",
            "cloudflarenet",
            "google",
            "amazon02",
            "akamaias",
            "telecom italia",
            "utc submissions",
            "microsoftcorpas",
            "indonesia",
            "beijing gu",
            "appleaustin",
            "sucurisec",
            "amazonaes",
            "limited",
            "tsara brashears",
            "pornhub",
            "thebrotherssabey",
            "then brothers sabey",
            "brian sabey",
            "apple",
            "icloud",
            "apple engineering",
            "soc",
            "hacker",
            "teams",
            "malvertizing",
            "cyberthreat",
            "cyber crime",
            "data",
            "v3 serial",
            "number",
            "cgb stgreater",
            "ecc domain",
            "server ca",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "remote",
            "remote attacker",
            "benjamin",
            "worm",
            "trojan",
            "win32",
            "trojanspy",
            "ransomware",
            "command and control",
            "cnc",
            "c2",
            "stealer",
            "password",
            "apple unlocker",
            "pornographers",
            "cyber stalking",
            "revenge rat",
            "masquerading",
            "scanning host",
            "phishing",
            "dns",
            "network",
            "cobalt strike",
            "mitre attack",
            "metro hacker",
            "t-mobile hacker",
            "stalker",
            "social engineering",
            "et",
            "torrent trecker",
            "view",
            "duckdns",
            "blackhat",
            "data center",
            "tracking",
            "illegal",
            "malware scripting",
            "malware spreader",
            "network rat",
            "multiple botnetworks"
          ],
          "references": [
            "https://thebrotherssabey.wordpress.com/",
            "acam-mdn.apple.com",
            "beacons.bcp.gvt.com",
            "cpcontacts.webcamara.online",
            "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
            "http://ti.hicloudcam.com",
            "http://alohatube.xyz/search/tsara-brashears",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://search.app.goo.gl/?ofl",
            "Worm:Win32/Benjamin",
            "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
            "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
            "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
            "applemusic-spotlight.myunidays.com",
            "nr-data.net",
            "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
            "blackhat.store",
            "api.telegram.org",
            "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Worm:Win32/Benjamin",
              "display_name": "Worm:Win32/Benjamin",
              "target": "/malware/Worm:Win32/Benjamin"
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Silk",
              "display_name": "Silk",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65a429795adf468b427a3c8b",
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2469,
            "URL": 6038,
            "FileHash-MD5": 169,
            "FileHash-SHA1": 157,
            "FileHash-SHA256": 3922,
            "CIDR": 2,
            "hostname": 2787,
            "email": 2,
            "CVE": 1
          },
          "indicator_count": 15547,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "633 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a429795adf468b427a3c8b",
          "name": "Apple | Worm:Win32/Benjamin | thebrotherssabey.com",
          "description": "Retaliation. Brian Sabey representing as an attorney and many other occupations contacted and socially engineered target. Uncertain of true name. Contacted 'alleged' SA assault victim. Made claims of representing a Jeffrey Scott Reimer DPT' alleged 'S' Assaulter.  Substantiated claims made with the twist of 'victim consented'. Mark Brian Sbabeys claims dismissed. Continues to hack, harass, intimidate target in every possible way. Hacking, monitoring, service, modification, phone contact, malicious texting, in person monitoring via colleagues, hacks into medical and medical billing centers, sells/leaks targets data on dark web.    Removed targets name from most pulses via  remote device access. Self whitelist. Everything he does is illegal.\n\nTarget not important enough to law enforcement.",
          "modified": "2024-02-13T17:04:19.437000",
          "created": "2024-01-14T18:35:37.757000",
          "tags": [
            "execution",
            "whois record",
            "contacted",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "copy",
            "historical ssl",
            "referrer",
            "urls url",
            "icmp",
            "malicious",
            "installer",
            "problems",
            "collections",
            "report",
            "phishing",
            "service tool",
            "greatness",
            "threat network",
            "emotet",
            "magniber",
            "startpage",
            "attack",
            "banker",
            "keylogger",
            "namecheap inc",
            "com laude",
            "ltd dba",
            "cloudflare",
            "porkbun llc",
            "ii llc",
            "csc corporate",
            "domains",
            "computer",
            "company limited",
            "first",
            "cloudflarenet",
            "google",
            "amazon02",
            "akamaias",
            "telecom italia",
            "utc submissions",
            "microsoftcorpas",
            "indonesia",
            "beijing gu",
            "appleaustin",
            "sucurisec",
            "amazonaes",
            "limited",
            "tsara brashears",
            "pornhub",
            "thebrotherssabey",
            "then brothers sabey",
            "brian sabey",
            "apple",
            "icloud",
            "apple engineering",
            "soc",
            "hacker",
            "teams",
            "malvertizing",
            "cyberthreat",
            "cyber crime",
            "data",
            "v3 serial",
            "number",
            "cgb stgreater",
            "ecc domain",
            "server ca",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "remote",
            "remote attacker",
            "benjamin",
            "worm",
            "trojan",
            "win32",
            "trojanspy",
            "ransomware",
            "command and control",
            "cnc",
            "c2",
            "stealer",
            "password",
            "apple unlocker",
            "pornographers",
            "cyber stalking",
            "revenge rat",
            "masquerading",
            "scanning host",
            "phishing",
            "dns",
            "network",
            "cobalt strike",
            "mitre attack",
            "metro hacker",
            "t-mobile hacker",
            "stalker",
            "social engineering",
            "et",
            "torrent trecker",
            "view",
            "duckdns",
            "blackhat",
            "data center",
            "tracking",
            "illegal",
            "malware scripting",
            "malware spreader",
            "network rat",
            "multiple botnetworks"
          ],
          "references": [
            "https://thebrotherssabey.wordpress.com/",
            "acam-mdn.apple.com",
            "beacons.bcp.gvt.com",
            "cpcontacts.webcamara.online",
            "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
            "http://ti.hicloudcam.com",
            "http://alohatube.xyz/search/tsara-brashears",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://search.app.goo.gl/?ofl",
            "Worm:Win32/Benjamin",
            "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
            "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
            "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
            "applemusic-spotlight.myunidays.com",
            "nr-data.net",
            "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
            "blackhat.store",
            "api.telegram.org",
            "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Worm:Win32/Benjamin",
              "display_name": "Worm:Win32/Benjamin",
              "target": "/malware/Worm:Win32/Benjamin"
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Silk",
              "display_name": "Silk",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2462,
            "URL": 5950,
            "FileHash-MD5": 168,
            "FileHash-SHA1": 156,
            "FileHash-SHA256": 3901,
            "CIDR": 2,
            "hostname": 2766,
            "email": 2,
            "CVE": 1
          },
          "indicator_count": 15408,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "837 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://ti.hicloudcam.com",
        "Worm:Win32/Benjamin",
        "http://alohatube.xyz/search/tsara-brashears",
        "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
        "beacons.bcp.gvt.com",
        "https://search.app.goo.gl/?ofl",
        "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
        "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php",
        "api.telegram.org",
        "acam-mdn.apple.com",
        "cpcontacts.webcamara.online",
        "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
        "applemusic-spotlight.myunidays.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://thebrotherssabey.wordpress.com/",
        "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
        "https://www.menlosecurity.com/blog/the-evolution-of-clickfix-from-cleartext-to-server-side-polymorphism",
        "blackhat.store",
        "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
        "nr-data.net"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [
            "Vidar",
            "Deerstealer"
          ],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Vidar",
            "Emotet",
            "Silk",
            "Tulach",
            "Worm:win32/benjamin",
            "Deerstealer",
            "Sabey",
            "#lowfi:siga:trojanspy:msil/keylogger"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6a0d971608b49dfc89267777",
      "name": "The Evolution of ClickFix: From Cleartext to Server Side Polymorphism",
      "description": "The ClickFix campaign has evolved from basic disk-based infections to sophisticated, obfuscated attacks using fake CAPTCHA pages that trick victims into executing malicious PowerShell commands. Initial variants used cleartext commands downloading batch scripts to deploy DeerStealer InfoStealer. The campaign advanced to fileless execution using XOR encryption or Base64 compression, operating entirely in memory. The most dangerous evolution involves server-side polymorphism, where attacker infrastructure dynamically generates unique obfuscated payloads for each victim, delivering Vidar InfoStealer. Active since March 2026 with surging activity through May, the campaign utilizes approximately 4,500 live domains. Both XOR and Base64 variants execute payloads in memory, download executables from attacker infrastructure, and delete traces to evade forensics.",
      "modified": "2026-05-21T16:10:15.685000",
      "created": "2026-05-20T11:12:22.964000",
      "tags": [
        "ClickFix",
        "server-side polymorphism",
        "fake CAPTCHA",
        "PowerShell",
        "DeerStealer",
        "Vidar",
        "InfoStealer",
        "fileless execution",
        "XOR encryption",
        "Base64 obfuscation"
      ],
      "references": [
        "https://www.menlosecurity.com/blog/the-evolution-of-clickfix-from-cleartext-to-server-side-polymorphism"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "DeerStealer",
          "display_name": "DeerStealer",
          "target": null
        },
        {
          "id": "Vidar",
          "display_name": "Vidar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1204.001",
          "name": "Malicious Link",
          "display_name": "T1204.001 - Malicious Link"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1059.001",
          "name": "PowerShell",
          "display_name": "T1059.001 - PowerShell"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1070.004",
          "name": "File Deletion",
          "display_name": "T1070.004 - File Deletion"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1555.003",
          "name": "Credentials from Web Browsers",
          "display_name": "T1555.003 - Credentials from Web Browsers"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1027.002",
          "name": "Software Packing",
          "display_name": "T1027.002 - Software Packing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3563,
        "IPv4": 3,
        "hostname": 936
      },
      "indicator_count": 4502,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386547,
      "modified_text": "10 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a12a215bd176163aa2b5bcc",
      "name": "The Evolution of ClickFix: From Cleartext to Server Side Polymorphism",
      "description": "",
      "modified": "2026-05-24T07:00:37.704000",
      "created": "2026-05-24T07:00:37.704000",
      "tags": [
        "ClickFix",
        "server-side polymorphism",
        "fake CAPTCHA",
        "PowerShell",
        "DeerStealer",
        "Vidar",
        "InfoStealer",
        "fileless execution",
        "XOR encryption",
        "Base64 obfuscation"
      ],
      "references": [
        "https://www.menlosecurity.com/blog/the-evolution-of-clickfix-from-cleartext-to-server-side-polymorphism"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "DeerStealer",
          "display_name": "DeerStealer",
          "target": null
        },
        {
          "id": "Vidar",
          "display_name": "Vidar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1204.001",
          "name": "Malicious Link",
          "display_name": "T1204.001 - Malicious Link"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1059.001",
          "name": "PowerShell",
          "display_name": "T1059.001 - PowerShell"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1070.004",
          "name": "File Deletion",
          "display_name": "T1070.004 - File Deletion"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1555.003",
          "name": "Credentials from Web Browsers",
          "display_name": "T1555.003 - Credentials from Web Browsers"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1027.002",
          "name": "Software Packing",
          "display_name": "T1027.002 - Software Packing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6a1283eeea5b0c771537ec61",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Tr1sa111",
        "id": "192483",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3563,
        "IPv4": 3,
        "hostname": 936
      },
      "indicator_count": 4502,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 278,
      "modified_text": "7 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a1283eeea5b0c771537ec61",
      "name": "The Evolution of ClickFix: From Cleartext to Server Side Polymorphism",
      "description": "",
      "modified": "2026-05-24T04:51:58.732000",
      "created": "2026-05-24T04:51:58.732000",
      "tags": [
        "ClickFix",
        "server-side polymorphism",
        "fake CAPTCHA",
        "PowerShell",
        "DeerStealer",
        "Vidar",
        "InfoStealer",
        "fileless execution",
        "XOR encryption",
        "Base64 obfuscation"
      ],
      "references": [
        "https://www.menlosecurity.com/blog/the-evolution-of-clickfix-from-cleartext-to-server-side-polymorphism"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "DeerStealer",
          "display_name": "DeerStealer",
          "target": null
        },
        {
          "id": "Vidar",
          "display_name": "Vidar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1204.001",
          "name": "Malicious Link",
          "display_name": "T1204.001 - Malicious Link"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1059.001",
          "name": "PowerShell",
          "display_name": "T1059.001 - PowerShell"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1070.004",
          "name": "File Deletion",
          "display_name": "T1070.004 - File Deletion"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1555.003",
          "name": "Credentials from Web Browsers",
          "display_name": "T1555.003 - Credentials from Web Browsers"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1027.002",
          "name": "Software Packing",
          "display_name": "T1027.002 - Software Packing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6a0d971608b49dfc89267777",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Tr1sa111",
        "id": "192483",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3563,
        "IPv4": 3,
        "hostname": 936
      },
      "indicator_count": 4502,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 278,
      "modified_text": "7 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a4885e735b9e8ba94805bc",
      "name": "Apple | Worm:Win32/Benjamin | thebrotherssabey.com",
      "description": "",
      "modified": "2024-09-05T06:51:42.608000",
      "created": "2024-01-15T01:20:30.730000",
      "tags": [
        "execution",
        "whois record",
        "contacted",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "copy",
        "historical ssl",
        "referrer",
        "urls url",
        "icmp",
        "malicious",
        "installer",
        "problems",
        "collections",
        "report",
        "phishing",
        "service tool",
        "greatness",
        "threat network",
        "emotet",
        "magniber",
        "startpage",
        "attack",
        "banker",
        "keylogger",
        "namecheap inc",
        "com laude",
        "ltd dba",
        "cloudflare",
        "porkbun llc",
        "ii llc",
        "csc corporate",
        "domains",
        "computer",
        "company limited",
        "first",
        "cloudflarenet",
        "google",
        "amazon02",
        "akamaias",
        "telecom italia",
        "utc submissions",
        "microsoftcorpas",
        "indonesia",
        "beijing gu",
        "appleaustin",
        "sucurisec",
        "amazonaes",
        "limited",
        "tsara brashears",
        "pornhub",
        "thebrotherssabey",
        "then brothers sabey",
        "brian sabey",
        "apple",
        "icloud",
        "apple engineering",
        "soc",
        "hacker",
        "teams",
        "malvertizing",
        "cyberthreat",
        "cyber crime",
        "data",
        "v3 serial",
        "number",
        "cgb stgreater",
        "ecc domain",
        "server ca",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "remote",
        "remote attacker",
        "benjamin",
        "worm",
        "trojan",
        "win32",
        "trojanspy",
        "ransomware",
        "command and control",
        "cnc",
        "c2",
        "stealer",
        "password",
        "apple unlocker",
        "pornographers",
        "cyber stalking",
        "revenge rat",
        "masquerading",
        "scanning host",
        "phishing",
        "dns",
        "network",
        "cobalt strike",
        "mitre attack",
        "metro hacker",
        "t-mobile hacker",
        "stalker",
        "social engineering",
        "et",
        "torrent trecker",
        "view",
        "duckdns",
        "blackhat",
        "data center",
        "tracking",
        "illegal",
        "malware scripting",
        "malware spreader",
        "network rat",
        "multiple botnetworks"
      ],
      "references": [
        "https://thebrotherssabey.wordpress.com/",
        "acam-mdn.apple.com",
        "beacons.bcp.gvt.com",
        "cpcontacts.webcamara.online",
        "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
        "http://ti.hicloudcam.com",
        "http://alohatube.xyz/search/tsara-brashears",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://search.app.goo.gl/?ofl",
        "Worm:Win32/Benjamin",
        "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
        "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
        "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
        "applemusic-spotlight.myunidays.com",
        "nr-data.net",
        "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
        "blackhat.store",
        "api.telegram.org",
        "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Worm:Win32/Benjamin",
          "display_name": "Worm:Win32/Benjamin",
          "target": "/malware/Worm:Win32/Benjamin"
        },
        {
          "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Silk",
          "display_name": "Silk",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65a429795adf468b427a3c8b",
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2469,
        "URL": 6038,
        "FileHash-MD5": 169,
        "FileHash-SHA1": 157,
        "FileHash-SHA256": 3922,
        "CIDR": 2,
        "hostname": 2787,
        "email": 2,
        "CVE": 1
      },
      "indicator_count": 15547,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "633 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a429795adf468b427a3c8b",
      "name": "Apple | Worm:Win32/Benjamin | thebrotherssabey.com",
      "description": "Retaliation. Brian Sabey representing as an attorney and many other occupations contacted and socially engineered target. Uncertain of true name. Contacted 'alleged' SA assault victim. Made claims of representing a Jeffrey Scott Reimer DPT' alleged 'S' Assaulter.  Substantiated claims made with the twist of 'victim consented'. Mark Brian Sbabeys claims dismissed. Continues to hack, harass, intimidate target in every possible way. Hacking, monitoring, service, modification, phone contact, malicious texting, in person monitoring via colleagues, hacks into medical and medical billing centers, sells/leaks targets data on dark web.    Removed targets name from most pulses via  remote device access. Self whitelist. Everything he does is illegal.\n\nTarget not important enough to law enforcement.",
      "modified": "2024-02-13T17:04:19.437000",
      "created": "2024-01-14T18:35:37.757000",
      "tags": [
        "execution",
        "whois record",
        "contacted",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "copy",
        "historical ssl",
        "referrer",
        "urls url",
        "icmp",
        "malicious",
        "installer",
        "problems",
        "collections",
        "report",
        "phishing",
        "service tool",
        "greatness",
        "threat network",
        "emotet",
        "magniber",
        "startpage",
        "attack",
        "banker",
        "keylogger",
        "namecheap inc",
        "com laude",
        "ltd dba",
        "cloudflare",
        "porkbun llc",
        "ii llc",
        "csc corporate",
        "domains",
        "computer",
        "company limited",
        "first",
        "cloudflarenet",
        "google",
        "amazon02",
        "akamaias",
        "telecom italia",
        "utc submissions",
        "microsoftcorpas",
        "indonesia",
        "beijing gu",
        "appleaustin",
        "sucurisec",
        "amazonaes",
        "limited",
        "tsara brashears",
        "pornhub",
        "thebrotherssabey",
        "then brothers sabey",
        "brian sabey",
        "apple",
        "icloud",
        "apple engineering",
        "soc",
        "hacker",
        "teams",
        "malvertizing",
        "cyberthreat",
        "cyber crime",
        "data",
        "v3 serial",
        "number",
        "cgb stgreater",
        "ecc domain",
        "server ca",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "remote",
        "remote attacker",
        "benjamin",
        "worm",
        "trojan",
        "win32",
        "trojanspy",
        "ransomware",
        "command and control",
        "cnc",
        "c2",
        "stealer",
        "password",
        "apple unlocker",
        "pornographers",
        "cyber stalking",
        "revenge rat",
        "masquerading",
        "scanning host",
        "phishing",
        "dns",
        "network",
        "cobalt strike",
        "mitre attack",
        "metro hacker",
        "t-mobile hacker",
        "stalker",
        "social engineering",
        "et",
        "torrent trecker",
        "view",
        "duckdns",
        "blackhat",
        "data center",
        "tracking",
        "illegal",
        "malware scripting",
        "malware spreader",
        "network rat",
        "multiple botnetworks"
      ],
      "references": [
        "https://thebrotherssabey.wordpress.com/",
        "acam-mdn.apple.com",
        "beacons.bcp.gvt.com",
        "cpcontacts.webcamara.online",
        "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
        "http://ti.hicloudcam.com",
        "http://alohatube.xyz/search/tsara-brashears",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://search.app.goo.gl/?ofl",
        "Worm:Win32/Benjamin",
        "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
        "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
        "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
        "applemusic-spotlight.myunidays.com",
        "nr-data.net",
        "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
        "blackhat.store",
        "api.telegram.org",
        "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Worm:Win32/Benjamin",
          "display_name": "Worm:Win32/Benjamin",
          "target": "/malware/Worm:Win32/Benjamin"
        },
        {
          "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Silk",
          "display_name": "Silk",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2462,
        "URL": 5950,
        "FileHash-MD5": 168,
        "FileHash-SHA1": 156,
        "FileHash-SHA256": 3901,
        "CIDR": 2,
        "hostname": 2766,
        "email": 2,
        "CVE": 1
      },
      "indicator_count": 15408,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "837 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "burstofclass.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "burstofclass.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780245664.16186
}