enhnhpibeofnhkhcakhmlbmhplfjhnjd (Instant Games), gglcalnjbighdaklagfdkclchfildlal (Chat and Meet for Google), ghkafclcjholabkaldcjpcojoegcfdcl (URL Shortener Plus)

Backend: jitt.wwevents[.]fun (138.68.118.237) Top extensions are: kjnmdomccekpkjomjhapnilfmeiglkid (Web for Telegram), hkhjfcfonfkhnpcpkhpbpmplnlcpcldh (Web for Google Messages), cejddnmmppcemhgenpcacdipichjjeme (PiP - Picture in Picture Plus), dcpmkllpnpfpojkjildgeoedikjbhodm (Web for Social)

OinkAndStuff (Facebook sued in 2021) appears to have rebranded as WWEvents, still operating ~20 Chrome extensions in the Web Store, a total of 100,000 users. All exts share a notification backend at jitt.wwevents[.]fun that can push text and redirect URLs without a store update. PUA/adware.

Stat of the week: Last week, 1,800+ distinct legitimate SaaS domains referred users to malicious sites. Besides delivering payloads, SaaS apps act as a referral path, where a link or embed in a trusted app leads to a malsite. Development tools and CRM were top referring categories.

Stat of the week: DLP events flagging sensitive data exposed publicly in SaaS apps rose 6% week over week. The exposure spans cloud storage, collaboration, webmail, dev tools, CRM, and GenAI apps, where a single public link makes internal data reachable by anyone.

Vini Egerland has been tracking the Underground campaign: A crypto-drain operation drains victims' exchange accounts. An injected Vidar-class stealer drives Chrome/Edge from rotating fronted /api/machine gates. It has already stolen ~$100K on-chain.

Shared IP: 74.50.88[.]154. Older cluster hosts (registered July 2025): go-us8.r2g[.]click, go-us8.redirpath[.]info. The Unruy samples communicating with that IP inject into IEXPLORE.EXE, hijack browser search, and persist through a Run key.

Unruy click-fraud infrastructure picked up new redirect domains. go-us8.gobridges[.]xyz and go-us8.linkhop[.]click, registered the same day in July at the same registrar, joined established go-us8.* hosts on 74.50.88[.]154. Three Unruy downloader samples communicate with that IP.

ClearFake payload delivery endpoint in use within a day of its registration. Delivery: rehearsal-b[.]com/4qX0LB/tm/oPpE/. ClearFake reads its loader config from BNB Smart Chain contract storage (EtherHiding)

Prompt injection detection runs in Netskope AI Guardrails, on Real-Time Protection policies, inspecting prompts and responses inline between Agents and LLMs.

Stat of the week: 85.6% of this week's prompt injection alerts related to Anthropic's Claude, out of 18 other apps.

IOCs aleverifocation[.]beer 178.16.52[.]101 00ad7d5e13df939402c6a4df3cd2e5c0f2d4a0aa97b6cb30396cd4dd66f9ebcd 039cd25a042b4f9ac9b75a07ec99be23250aec2734088f2701c06789be94abda

ClickFix lures are running off a .beer TLD cluster. aleverifocation[.]beer went into use a day after registration, taking Win+R paste victim checkins at /api.php?s=<token>&_v=<build>. Its IP 178.16.52[.]101 hosts 10+ fake fingerprint/verification/ID pages.