{
  "type": "Domain",
  "indicator": "temopix.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/temopix.com",
    "alexa": "http://www.alexa.com/siteinfo/temopix.com",
    "indicator": "temopix.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4124362623,
      "indicator": "temopix.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "68addd58d3bae863fdf8d5ae",
          "name": "Major August 2025 Cyber Attacks: 7-Stage Tycoon2FA Phishing, New ClickFix Campaign, and Salty2FA",
          "description": "In August 2025, significant cyber attacks emerged, including a 7-stage Tycoon2FA phishing campaign targeting government, military, and financial institutions across the US, UK, Canada, and Europe. The attack uses multiple verification steps to evade security systems. A new ClickFix campaign delivered the Rhadamanthys Stealer using PNG steganography, indicating increased sophistication in payload delivery. Salty2FA, a new Phishing-as-a-Service framework attributed to Storm-1575, was discovered targeting Microsoft 365 accounts globally, capable of bypassing various 2FA methods. These attacks demonstrate the evolution of phishing kits and stealers, emphasizing the need for behavioral analysis and real-time threat intelligence in cybersecurity defenses.",
          "modified": "2025-09-29T07:48:12.468000",
          "created": "2025-08-26T16:14:13.454000",
          "tags": [
            "rhadamanthys stealer",
            "phishing",
            "tycoon2fa",
            "salty2fa",
            "clickfix"
          ],
          "references": [
            "https://any.run/cybersecurity-blog/cyber-attacks-august-2025"
          ],
          "public": 1,
          "adversary": "Storm-1575",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Tycoon2FA",
              "display_name": "Tycoon2FA",
              "target": null
            },
            {
              "id": "Rhadamanthys Stealer",
              "display_name": "Rhadamanthys Stealer",
              "target": null
            },
            {
              "id": "Salty2FA",
              "display_name": "Salty2FA",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1497.001",
              "name": "System Checks",
              "display_name": "T1497.001 - System Checks"
            },
            {
              "id": "T1218.007",
              "name": "Msiexec",
              "display_name": "T1218.007 - Msiexec"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027.003",
              "name": "Steganography",
              "display_name": "T1027.003 - Steganography"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            }
          ],
          "industries": [
            "Government",
            "Defense",
            "Finance",
            "Energy",
            "Manufacturing",
            "Healthcare",
            "Telecommunications",
            "Education"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 60,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 17,
            "hostname": 2,
            "URL": 5
          },
          "indicator_count": 24,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 387131,
          "modified_text": "247 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68bff3e33540d09bd27e7c8c",
          "name": "EbeeSep2025 Pt2",
          "description": "",
          "modified": "2025-10-11T12:03:16.109000",
          "created": "2025-09-09T09:31:15.081000",
          "tags": [],
          "references": [
            "Sep week2.pdf"
          ],
          "public": 1,
          "adversary": "Multiple",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 175,
            "FileHash-SHA1": 165,
            "FileHash-SHA256": 382,
            "domain": 75,
            "hostname": 17,
            "FilePath": 4,
            "URL": 17
          },
          "indicator_count": 835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 39,
          "modified_text": "235 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68b12ad3b4c03bf48aa31bba",
          "name": "Major August 2025 Cyber Attacks: 7-Stage Tycoon2FA Phishing, New ClickFix Campaign, and Salty2FA",
          "description": "",
          "modified": "2025-09-27T18:07:05.748000",
          "created": "2025-08-29T04:21:39.146000",
          "tags": [
            "rhadamanthys stealer",
            "phishing",
            "tycoon2fa",
            "salty2fa",
            "clickfix"
          ],
          "references": [
            "https://any.run/cybersecurity-blog/cyber-attacks-august-2025"
          ],
          "public": 1,
          "adversary": "Storm-1575",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Tycoon2FA",
              "display_name": "Tycoon2FA",
              "target": null
            },
            {
              "id": "Rhadamanthys Stealer",
              "display_name": "Rhadamanthys Stealer",
              "target": null
            },
            {
              "id": "Salty2FA",
              "display_name": "Salty2FA",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1497.001",
              "name": "System Checks",
              "display_name": "T1497.001 - System Checks"
            },
            {
              "id": "T1218.007",
              "name": "Msiexec",
              "display_name": "T1218.007 - Msiexec"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027.003",
              "name": "Steganography",
              "display_name": "T1027.003 - Steganography"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            }
          ],
          "industries": [
            "Government",
            "Defense",
            "Finance",
            "Energy",
            "Manufacturing",
            "Healthcare",
            "Telecommunications",
            "Education"
          ],
          "TLP": "white",
          "cloned_from": "68addd58d3bae863fdf8d5ae",
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Tr1sa111",
            "id": "192483",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 17,
            "hostname": 2,
            "URL": 5
          },
          "indicator_count": 24,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 280,
          "modified_text": "248 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ae904ac9fc983f185ff00e",
          "name": "Major Cyber Attacks in August 2025: 7-Stage Tycoon2FA Phishing, New ClickFix Campaign, and Salty2FA.",
          "description": "In August 2025, the cyber landscape experienced a notable increase in sophisticated phishing campaigns, highlighted by the emergence of the Tycoon2FA framework, which employs a unique seven-stage phishing attack strategy. This approach significantly deviates from conventional phishing techniques, enhancing its effectiveness by incorporating elements such as CAPTCHAs, button-hold checks, and validation screens. Each phase of the Tycoon2FA execution is meticulously crafted to exhaust the user's defenses, effectively circumventing automated security measures. By the time victims reach the final phishing panel, many security systems have already been compromised or bypassed.",
          "modified": "2025-09-26T04:01:01.586000",
          "created": "2025-08-27T04:57:46.008000",
          "tags": [
            "iocs",
            "clickfix",
            "salty2fa",
            "rhadamanthys",
            "tycoon2fa",
            "ti lookup",
            "tycoon",
            "august",
            "lookup",
            "canada",
            "sandbox",
            "hold",
            "soar",
            "asyncrat",
            "june",
            "netsupport",
            "msi",
            "storm-1575"
          ],
          "references": [
            "https://any.run/cybersecurity-blog/cyber-attacks-august-2025/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Rhadamanthys",
              "display_name": "Rhadamanthys",
              "target": null
            },
            {
              "id": "ClickFix",
              "display_name": "ClickFix",
              "target": null
            },
            {
              "id": "NetSupport",
              "display_name": "NetSupport",
              "target": null
            },
            {
              "id": "MSI",
              "display_name": "MSI",
              "target": null
            },
            {
              "id": "Storm-1575",
              "display_name": "Storm-1575",
              "target": null
            },
            {
              "id": "Tycoon2FA",
              "display_name": "Tycoon2FA",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1218.007",
              "name": "Msiexec",
              "display_name": "T1218.007 - Msiexec"
            },
            {
              "id": "T1497.001",
              "name": "System Checks",
              "display_name": "T1497.001 - System Checks"
            },
            {
              "id": "T1027.003",
              "name": "Steganography",
              "display_name": "T1027.003 - Steganography"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            }
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Telecom",
            "Military",
            "Financial",
            "Banks",
            "Finance",
            "Energy",
            "Manufacturing",
            "Education",
            "Logistics",
            "Banking",
            "Retail",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3,
            "domain": 25,
            "hostname": 1
          },
          "indicator_count": 29,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 544,
          "modified_text": "250 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68aeb36887155cafa066fbb5",
          "name": "IOC - Major August 2025 Cyber Attacks",
          "description": "",
          "modified": "2025-09-25T16:04:10.206000",
          "created": "2025-08-27T07:27:36.416000",
          "tags": [
            "rhadamanthys stealer",
            "phishing",
            "tycoon2fa",
            "salty2fa",
            "clickfix"
          ],
          "references": [
            "https://any.run/cybersecurity-blog/cyber-attacks-august-2025"
          ],
          "public": 1,
          "adversary": "Storm-1575",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Tycoon2FA",
              "display_name": "Tycoon2FA",
              "target": null
            },
            {
              "id": "Rhadamanthys Stealer",
              "display_name": "Rhadamanthys Stealer",
              "target": null
            },
            {
              "id": "Salty2FA",
              "display_name": "Salty2FA",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1497.001",
              "name": "System Checks",
              "display_name": "T1497.001 - System Checks"
            },
            {
              "id": "T1218.007",
              "name": "Msiexec",
              "display_name": "T1218.007 - Msiexec"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027.003",
              "name": "Steganography",
              "display_name": "T1027.003 - Steganography"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            }
          ],
          "industries": [
            "Government",
            "Defense",
            "Finance",
            "Energy",
            "Manufacturing",
            "Healthcare",
            "Telecommunications",
            "Education"
          ],
          "TLP": "white",
          "cloned_from": "68addd58d3bae863fdf8d5ae",
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "celestre",
            "id": "295357",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 13,
            "hostname": 1
          },
          "indicator_count": 14,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "250 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://any.run/cybersecurity-blog/cyber-attacks-august-2025/",
        "https://any.run/cybersecurity-blog/cyber-attacks-august-2025",
        "Sep week2.pdf"
      ],
      "related": {
        "alienvault": {
          "adversary": [
            "Storm-1575"
          ],
          "malware_families": [
            "Tycoon2fa",
            "Salty2fa",
            "Rhadamanthys stealer"
          ],
          "industries": [
            "Telecommunications",
            "Energy",
            "Defense",
            "Healthcare",
            "Education",
            "Government",
            "Manufacturing",
            "Finance"
          ]
        },
        "other": {
          "adversary": [
            "Storm-1575",
            "Multiple"
          ],
          "malware_families": [
            "Clickfix",
            "Netsupport",
            "Rhadamanthys",
            "Storm-1575",
            "Salty2fa",
            "Tycoon2fa",
            "Rhadamanthys stealer",
            "Msi"
          ],
          "industries": [
            "Logistics",
            "Telecommunications",
            "Energy",
            "Technology",
            "Defense",
            "Healthcare",
            "Education",
            "Banks",
            "Telecom",
            "Government",
            "Military",
            "Banking",
            "Retail",
            "Financial",
            "Manufacturing",
            "Finance"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "68addd58d3bae863fdf8d5ae",
      "name": "Major August 2025 Cyber Attacks: 7-Stage Tycoon2FA Phishing, New ClickFix Campaign, and Salty2FA",
      "description": "In August 2025, significant cyber attacks emerged, including a 7-stage Tycoon2FA phishing campaign targeting government, military, and financial institutions across the US, UK, Canada, and Europe. The attack uses multiple verification steps to evade security systems. A new ClickFix campaign delivered the Rhadamanthys Stealer using PNG steganography, indicating increased sophistication in payload delivery. Salty2FA, a new Phishing-as-a-Service framework attributed to Storm-1575, was discovered targeting Microsoft 365 accounts globally, capable of bypassing various 2FA methods. These attacks demonstrate the evolution of phishing kits and stealers, emphasizing the need for behavioral analysis and real-time threat intelligence in cybersecurity defenses.",
      "modified": "2025-09-29T07:48:12.468000",
      "created": "2025-08-26T16:14:13.454000",
      "tags": [
        "rhadamanthys stealer",
        "phishing",
        "tycoon2fa",
        "salty2fa",
        "clickfix"
      ],
      "references": [
        "https://any.run/cybersecurity-blog/cyber-attacks-august-2025"
      ],
      "public": 1,
      "adversary": "Storm-1575",
      "targeted_countries": [
        "United States of America",
        "Canada",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Tycoon2FA",
          "display_name": "Tycoon2FA",
          "target": null
        },
        {
          "id": "Rhadamanthys Stealer",
          "display_name": "Rhadamanthys Stealer",
          "target": null
        },
        {
          "id": "Salty2FA",
          "display_name": "Salty2FA",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1497.001",
          "name": "System Checks",
          "display_name": "T1497.001 - System Checks"
        },
        {
          "id": "T1218.007",
          "name": "Msiexec",
          "display_name": "T1218.007 - Msiexec"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027.003",
          "name": "Steganography",
          "display_name": "T1027.003 - Steganography"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        }
      ],
      "industries": [
        "Government",
        "Defense",
        "Finance",
        "Energy",
        "Manufacturing",
        "Healthcare",
        "Telecommunications",
        "Education"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 60,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 17,
        "hostname": 2,
        "URL": 5
      },
      "indicator_count": 24,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 387131,
      "modified_text": "247 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68bff3e33540d09bd27e7c8c",
      "name": "EbeeSep2025 Pt2",
      "description": "",
      "modified": "2025-10-11T12:03:16.109000",
      "created": "2025-09-09T09:31:15.081000",
      "tags": [],
      "references": [
        "Sep week2.pdf"
      ],
      "public": 1,
      "adversary": "Multiple",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 175,
        "FileHash-SHA1": 165,
        "FileHash-SHA256": 382,
        "domain": 75,
        "hostname": 17,
        "FilePath": 4,
        "URL": 17
      },
      "indicator_count": 835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 39,
      "modified_text": "235 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68b12ad3b4c03bf48aa31bba",
      "name": "Major August 2025 Cyber Attacks: 7-Stage Tycoon2FA Phishing, New ClickFix Campaign, and Salty2FA",
      "description": "",
      "modified": "2025-09-27T18:07:05.748000",
      "created": "2025-08-29T04:21:39.146000",
      "tags": [
        "rhadamanthys stealer",
        "phishing",
        "tycoon2fa",
        "salty2fa",
        "clickfix"
      ],
      "references": [
        "https://any.run/cybersecurity-blog/cyber-attacks-august-2025"
      ],
      "public": 1,
      "adversary": "Storm-1575",
      "targeted_countries": [
        "United States of America",
        "Canada",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Tycoon2FA",
          "display_name": "Tycoon2FA",
          "target": null
        },
        {
          "id": "Rhadamanthys Stealer",
          "display_name": "Rhadamanthys Stealer",
          "target": null
        },
        {
          "id": "Salty2FA",
          "display_name": "Salty2FA",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1497.001",
          "name": "System Checks",
          "display_name": "T1497.001 - System Checks"
        },
        {
          "id": "T1218.007",
          "name": "Msiexec",
          "display_name": "T1218.007 - Msiexec"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027.003",
          "name": "Steganography",
          "display_name": "T1027.003 - Steganography"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        }
      ],
      "industries": [
        "Government",
        "Defense",
        "Finance",
        "Energy",
        "Manufacturing",
        "Healthcare",
        "Telecommunications",
        "Education"
      ],
      "TLP": "white",
      "cloned_from": "68addd58d3bae863fdf8d5ae",
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Tr1sa111",
        "id": "192483",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 17,
        "hostname": 2,
        "URL": 5
      },
      "indicator_count": 24,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 280,
      "modified_text": "248 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ae904ac9fc983f185ff00e",
      "name": "Major Cyber Attacks in August 2025: 7-Stage Tycoon2FA Phishing, New ClickFix Campaign, and Salty2FA.",
      "description": "In August 2025, the cyber landscape experienced a notable increase in sophisticated phishing campaigns, highlighted by the emergence of the Tycoon2FA framework, which employs a unique seven-stage phishing attack strategy. This approach significantly deviates from conventional phishing techniques, enhancing its effectiveness by incorporating elements such as CAPTCHAs, button-hold checks, and validation screens. Each phase of the Tycoon2FA execution is meticulously crafted to exhaust the user's defenses, effectively circumventing automated security measures. By the time victims reach the final phishing panel, many security systems have already been compromised or bypassed.",
      "modified": "2025-09-26T04:01:01.586000",
      "created": "2025-08-27T04:57:46.008000",
      "tags": [
        "iocs",
        "clickfix",
        "salty2fa",
        "rhadamanthys",
        "tycoon2fa",
        "ti lookup",
        "tycoon",
        "august",
        "lookup",
        "canada",
        "sandbox",
        "hold",
        "soar",
        "asyncrat",
        "june",
        "netsupport",
        "msi",
        "storm-1575"
      ],
      "references": [
        "https://any.run/cybersecurity-blog/cyber-attacks-august-2025/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Rhadamanthys",
          "display_name": "Rhadamanthys",
          "target": null
        },
        {
          "id": "ClickFix",
          "display_name": "ClickFix",
          "target": null
        },
        {
          "id": "NetSupport",
          "display_name": "NetSupport",
          "target": null
        },
        {
          "id": "MSI",
          "display_name": "MSI",
          "target": null
        },
        {
          "id": "Storm-1575",
          "display_name": "Storm-1575",
          "target": null
        },
        {
          "id": "Tycoon2FA",
          "display_name": "Tycoon2FA",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1218.007",
          "name": "Msiexec",
          "display_name": "T1218.007 - Msiexec"
        },
        {
          "id": "T1497.001",
          "name": "System Checks",
          "display_name": "T1497.001 - System Checks"
        },
        {
          "id": "T1027.003",
          "name": "Steganography",
          "display_name": "T1027.003 - Steganography"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        }
      ],
      "industries": [
        "Government",
        "Healthcare",
        "Telecom",
        "Military",
        "Financial",
        "Banks",
        "Finance",
        "Energy",
        "Manufacturing",
        "Education",
        "Logistics",
        "Banking",
        "Retail",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 33,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3,
        "domain": 25,
        "hostname": 1
      },
      "indicator_count": 29,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 544,
      "modified_text": "250 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68aeb36887155cafa066fbb5",
      "name": "IOC - Major August 2025 Cyber Attacks",
      "description": "",
      "modified": "2025-09-25T16:04:10.206000",
      "created": "2025-08-27T07:27:36.416000",
      "tags": [
        "rhadamanthys stealer",
        "phishing",
        "tycoon2fa",
        "salty2fa",
        "clickfix"
      ],
      "references": [
        "https://any.run/cybersecurity-blog/cyber-attacks-august-2025"
      ],
      "public": 1,
      "adversary": "Storm-1575",
      "targeted_countries": [
        "United States of America",
        "Canada",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Tycoon2FA",
          "display_name": "Tycoon2FA",
          "target": null
        },
        {
          "id": "Rhadamanthys Stealer",
          "display_name": "Rhadamanthys Stealer",
          "target": null
        },
        {
          "id": "Salty2FA",
          "display_name": "Salty2FA",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1497.001",
          "name": "System Checks",
          "display_name": "T1497.001 - System Checks"
        },
        {
          "id": "T1218.007",
          "name": "Msiexec",
          "display_name": "T1218.007 - Msiexec"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027.003",
          "name": "Steganography",
          "display_name": "T1027.003 - Steganography"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        }
      ],
      "industries": [
        "Government",
        "Defense",
        "Finance",
        "Energy",
        "Manufacturing",
        "Healthcare",
        "Telecommunications",
        "Education"
      ],
      "TLP": "white",
      "cloned_from": "68addd58d3bae863fdf8d5ae",
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "celestre",
        "id": "295357",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 13,
        "hostname": 1
      },
      "indicator_count": 14,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "250 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "temopix.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "temopix.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780500749.6591046
}