ShadowOpCode
@shadowopcode
Malware analyst & reverse engineer 🧠
Threat intel on stealers, RATs, live campaigns 🕵️
Technical analysis. No buzzwords.
📍DM open for research collabs
ID: 1923033485087834112
https://github.com/ShadowOpCode 15-05-2025 15:11:39
176 Tweet
291 Followers
96 Following
![#ClickFix #FakeCAPTCHA in an italian website
hxxps://www.chiocciola40[.]it/
hxxp://te.vakun[.]ru/ptg90q8t
hxxp://dqay.ci6ef[.]ru/sinkers
<a href="/anyrun_app/">ANY.RUN</a> analysis: app.any.run/tasks/1e167278…](https://pbs.twimg.com/media/G39AxyeXIAArEy_.png "ShadowOpCode (@shadowopcode) on Twitter photo #ClickFix #FakeCAPTCHA in an italian website
hxxps://www.chiocciola40[.]it/
hxxp://te.vakun[.]ru/ptg90q8t
hxxp://dqay.ci6ef[.]ru/sinkers
<a href=\"/anyrun_app/\">ANY.RUN</a> analysis: app.any.run/tasks/1e167278…")
![🚨#Formbook #Xloader spotted in a malspam campaign in #Italy
⚠️Using another "Lorem Ipsum Dolores" variation!
Related tweet: x.com/ShadowOpCode/s…
<a href="/anyrun_app/">ANY.RUN</a> analysis: app.any.run/tasks/43bfa36b…
C2: www[.]grevla[.]top](https://pbs.twimg.com/media/G4l8WqSWoAA5Twt.jpg "ShadowOpCode (@shadowopcode) on Twitter photo 🚨#Formbook #Xloader spotted in a malspam campaign in #Italy
⚠️Using another \"Lorem Ipsum Dolores\" variation!
Related tweet: x.com/ShadowOpCode/s…
<a href=\"/anyrun_app/\">ANY.RUN</a> analysis: app.any.run/tasks/43bfa36b…
C2: www[.]grevla[.]top")
HTA file deobfuscation from the "fake DMCA report" phishing campaign. Key features shown in the screenshots John Hammond vx-underground ShadowOpCode x.com/_JohnHammond/s…
⚠️ALERT⚠️ there is an OPEN webshell on hxxps://boldcleaningsolutionsatl[.]com/ NEW domains: boldcompanions[.]com boldinnovationspetcare[.]com Cert AgID Gianni Amato JAMESWT vx-underground a lot of malwere inside 😋 cc: tobersotski x.com/AgidCert/statu…
![⚠️ALERT⚠️
there is an OPEN webshell on hxxps://boldcleaningsolutionsatl[.]com/
NEW domains:
boldcompanions[.]com
boldinnovationspetcare[.]com
<a href="/AgidCert/">Cert AgID</a> <a href="/guelfoweb/">Gianni Amato</a> <a href="/JAMESWT_WT/">JAMESWT</a>
<a href="/vxunderground/">vx-underground</a> a lot of malwere inside 😋
cc: <a href="/tobersotski/">tobersotski</a>
x.com/AgidCert/statu…](https://pbs.twimg.com/media/G5dnkdJXsAAf2pm.jpg "ShadowOpCode (@shadowopcode) on Twitter photo ⚠️ALERT⚠️
there is an OPEN webshell on hxxps://boldcleaningsolutionsatl[.]com/
NEW domains:
boldcompanions[.]com
boldinnovationspetcare[.]com
<a href=\"/AgidCert/\">Cert AgID</a> <a href=\"/guelfoweb/\">Gianni Amato</a> <a href=\"/JAMESWT_WT/\">JAMESWT</a>
<a href=\"/vxunderground/\">vx-underground</a> a lot of malwere inside 😋
cc: <a href=\"/tobersotski/\">tobersotski</a>
x.com/AgidCert/statu…")
Caminho Loader Malware Analysis #CaminhoLoader #malware #ThreatIntel Szabolcs Schmidt ShadowOpCode x.com/smica83/status…
Phishing "Pedaggio non pagato" autostde[.]com domain created today (2025-11-19) Cert AgID JAMESWT illegalFawn Gianni Amato Andrea (Drego) Draghetti 👨🏻💻 🎣 Simplicio Sam L.
![Phishing "Pedaggio non pagato"
autostde[.]com domain created today (2025-11-19)
<a href="/AgidCert/">Cert AgID</a>
<a href="/JAMESWT_WT/">JAMESWT</a> <a href="/illegalFawn/">illegalFawn</a> <a href="/guelfoweb/">Gianni Amato</a> <a href="/AndreaDraghetti/">Andrea (Drego) Draghetti 👨🏻💻 🎣</a> <a href="/marsomx_/">Simplicio Sam L.</a>](https://pbs.twimg.com/media/G6H5Bd3WcAA6Ej6.png "tobersotski (@tobersotski) on Twitter photo Phishing \"Pedaggio non pagato\"
autostde[.]com domain created today (2025-11-19)
<a href=\"/AgidCert/\">Cert AgID</a>
<a href=\"/JAMESWT_WT/\">JAMESWT</a> <a href=\"/illegalFawn/\">illegalFawn</a> <a href=\"/guelfoweb/\">Gianni Amato</a> <a href=\"/AndreaDraghetti/\">Andrea (Drego) Draghetti 👨🏻💻 🎣</a> <a href=\"/marsomx_/\">Simplicio Sam L.</a>")