ShadowOpCode
@shadowopcode
Malware analyst & reverse engineer 🧠
Threat intel on stealers, RATs, live campaigns 🕵️
Technical analysis. No buzzwords.
📍DM open for research collabs
ID: 1923033485087834112
https://github.com/ShadowOpCode 15-05-2025 15:11:39
176 Tweet
291 Takipçi
96 Takip Edilen
![#ClickFix #FakeCAPTCHA in an italian website
hxxps://www.chiocciola40[.]it/
hxxp://te.vakun[.]ru/ptg90q8t
hxxp://dqay.ci6ef[.]ru/sinkers
<a href="/anyrun_app/">ANY.RUN</a> analysis: app.any.run/tasks/1e167278…](https://pbs.twimg.com/media/G39AxyeXIAArEy_.png "ShadowOpCode (@shadowopcode) on Twitter photo #ClickFix #FakeCAPTCHA in an italian website
hxxps://www.chiocciola40[.]it/
hxxp://te.vakun[.]ru/ptg90q8t
hxxp://dqay.ci6ef[.]ru/sinkers
<a href=\"/anyrun_app/\">ANY.RUN</a> analysis: app.any.run/tasks/1e167278…")
![🚨#Formbook #Xloader spotted in a malspam campaign in #Italy
⚠️Using another "Lorem Ipsum Dolores" variation!
Related tweet: x.com/ShadowOpCode/s…
<a href="/anyrun_app/">ANY.RUN</a> analysis: app.any.run/tasks/43bfa36b…
C2: www[.]grevla[.]top](https://pbs.twimg.com/media/G4l8WqSWoAA5Twt.jpg "ShadowOpCode (@shadowopcode) on Twitter photo 🚨#Formbook #Xloader spotted in a malspam campaign in #Italy
⚠️Using another \"Lorem Ipsum Dolores\" variation!
Related tweet: x.com/ShadowOpCode/s…
<a href=\"/anyrun_app/\">ANY.RUN</a> analysis: app.any.run/tasks/43bfa36b…
C2: www[.]grevla[.]top")
⚠️ALERT⚠️ there is an OPEN webshell on hxxps://boldcleaningsolutionsatl[.]com/ NEW domains: boldcompanions[.]com boldinnovationspetcare[.]com Cert AgID Gianni Amato JAMESWT vx-underground a lot of malwere inside 😋 cc: tobersotski x.com/AgidCert/statu…
![⚠️ALERT⚠️
there is an OPEN webshell on hxxps://boldcleaningsolutionsatl[.]com/
NEW domains:
boldcompanions[.]com
boldinnovationspetcare[.]com
<a href="/AgidCert/">Cert AgID</a> <a href="/guelfoweb/">Gianni Amato</a> <a href="/JAMESWT_WT/">JAMESWT</a>
<a href="/vxunderground/">vx-underground</a> a lot of malwere inside 😋
cc: <a href="/tobersotski/">tobersotski</a>
x.com/AgidCert/statu…](https://pbs.twimg.com/media/G5dnkdJXsAAf2pm.jpg "ShadowOpCode (@shadowopcode) on Twitter photo ⚠️ALERT⚠️
there is an OPEN webshell on hxxps://boldcleaningsolutionsatl[.]com/
NEW domains:
boldcompanions[.]com
boldinnovationspetcare[.]com
<a href=\"/AgidCert/\">Cert AgID</a> <a href=\"/guelfoweb/\">Gianni Amato</a> <a href=\"/JAMESWT_WT/\">JAMESWT</a>
<a href=\"/vxunderground/\">vx-underground</a> a lot of malwere inside 😋
cc: <a href=\"/tobersotski/\">tobersotski</a>
x.com/AgidCert/statu…")
