WhoisXML API uncovered 62,081 domains referencing the 2026 U.S. midterm elections, including look-alike candidate stores traced to a few registrants. Download the threat research materials now.
Continue readingIlluminating ShadyPanda DNS Infrastructure Facts
ShadyPanda launched a seven-year-long campaign that affected the browsers of 4.3 million Chrome and Edge users to date. The actor’s secret? Some malicious extensions were featured and verified by Google, resulting in instant trust and massive distribution.
Koi Security identified seven IoCs1 comprising four domains and three subdomains. After extracting unique domains from the subdomains, we accumulated six domains and three subdomains for further analysis.
Our in-depth investigation led to these discoveries:
- 105 unique client IP addresses communicated with four domains identified as IoCs
- 735 email-connected domains, one turned out to be malicious
- Seven IP addresses, six turned out to be malicious
- 18 IP-connected domains
- 76 string-connected domains
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
[1] https://www.koi.ai/blog/4-million-browsers-infected-inside-shadypanda-7-year-malware-campaign#heading-7