Brad

@malware-traffic-analysis.net

979 Followers 95 Following

Sharing information on malicious network traffic and malware samples at https://www.malware-traffic-analysis.net/

Fake Homebrew (Brew) page with ClickFix style instructions that would infect a potential victim's macOS host with AMOS Stealer.
Screenshot of Google search results with an ad leading to the fake Claude page.
Fake Homebrew page pushing malware
Screenshot of the blog page documenting my Shub Stealer infection
ClickFix style page for macOS malware disguised as Claude download.
SmartApeSG fake CAPTCHA (verify you are human page) when viewing a legitimate but compromised website.
Screenshot of and email distributing XLoader (Formbook)
SmartApeSG script injected into page from compromised website.
Screenshot of the initial email with the malicious attachment.
Screenshot of the email
"Where is she!??!!??" Wait a minute, that's Batman. This is Liam Neeson.
Screenshot of my blog post with the files and information from this infection.
Fake "Verify You Are Human" CAPTCHA page that can appear when viewing a page from a legitimate but compromised website.
Screenshot showing Google search results for a cracked version of ArcGIS where I specify site:drive.google.com. The results shown here all lead to PDF files hosted on Google Drive, and these PDF files contains links that lead to malware.
Screenshot from an infected Windows host showing Remcos RAT and how it is persistent.
Some of the scans, probes, and web traffic from the pcap filtered in Wireshark.
Screenshot of the email, its attachment, and the VBS file within the attachment for VIP Recovery malware.
Fake CAPTCHA window and ClickFix script after visiting legitimate, but compromised website.
One of the emails and its associated attachment for MassLogger malware.
Example of a legitimate but compromised site showing the SmartApeSG fake CAPTCHA page.
Injected KongTuke script in page from compromised website.
A screenshot of my blog post for the Lumma Stealer infection
Screenshot of my blog post to share information on this Lumma Stealer infection with follow-up malware.
Example of initial URL from sites.google[.]com.
Downloading the initial file, a DMG image.
Screenshot of the post with the pcaps, files, and other info from the Kongtuke ClickFix activity using the finger command on 2025-12-11.
Screenshot showing links for the three December 2025 blog posts I have so far.
The scam starts with an email that links to a suspicious web page. I've somehow earned $138,246.83 USD... Let's go down this rabbit hole!
Page to download the initial file.
Malicious Windows shortcut (LNK) files on the WebDAV server. Both are the same file with different names.
Traffic from the infection filtered in Wireshark.
Screen shot of the blog post.
Screenshot of icon for the malicious app on a cell phone.
Screenshot of the page from my website with the post for this information.
Screenshot of the email.
Screenshot of the email.
Screesnhot of the page from my blog with the traffic, malware files, and indicators of compromise for this Lumma Stealer infection.
Kongtuke style injected script in page from compromised website
Fake CAPTHA page generated by SmartApeSG script injected into compromised website.
Page from compromised site displaying fake CAPTCHA page.
An image displaying the URL chain followed to get the initial zip archive downloaded for this infection.
Screenshot of a Facebook post that linked to a page providing the password-protected 7-zip archive for Lumma Stealer. The archive is named "NCH Debut Video Capture Software Pro 11.2 Beta Crack full version.7z" in an attempt to disguise it as a software crack.
Screenshot of the page from my web site to download a password-protected zip archive containing the pcap.
Traffic from an infection filtered in Wireshark.
Screenshot of ClickFix-style fake verification page with text for the script injected into the viewer's hijacked clipboard.
Screenshot of downloading a password-protected 7-zip archive for Lumma Stealer through a web browser, example 1 of 2.
Injected SmartApeSG script in page from legitimate but compromised website. This injected script leads to the ClickFix page.
Step 1: Downloading the malware that's distributed as a cracked version of Turnitin. Hint: It doesn't install Turnitin, it just installs Lumma Stealer.
Screenshot of the web page for the associated blog post.