WhoisXML API uncovered 62,081 domains referencing the 2026 U.S. midterm elections, including look-alike candidate stores traced to a few registrants. Download the threat research materials now.
Continue readingUncovering Suspicious Download Pages Linked to App Installer Abuse
Several financially motivated threat actors were seen abusing Microsoft’s App Installer, likely in an effort to distribute ransomware.
Building on the list of domains and subdomains tagged as IoCs,1 WhoisXML API researchers found more than 1,100 potential artifacts comprising:
- Four email-connected domains
- 127 IP-connected domains
- 401 string-connected domains
- 596 string-connected subdomains
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/