Research Center

Check Point Research uncovered¹ a large-scale operation that impersonated open-source and freeware projects to capture search traffic. The convincing fake project portals loaded a CloudFront-hosted JavaScript staging layer that rerouted download clicks into a strictly gated traffic distribution system (TDS). Downstream redirect chains then steered selected users to malware delivery infrastructure for RemusStealer, AnimateClipper, and the SessionGate framework.

The original analysis publicized 27 network IoCs. Aided by the WhoisXML API MCP Server², we investigated 30 IoCs—eight subdomains, 19 domains, and three IP addresses—after extracting the unique apex domains from the subdomain IoCs and running domain legitimacy and activity checks.

Grand Theft Auto VI is scheduled for release on 19 November 2026. Domain registration activity referencing the game has already built up months ahead of launch, with a sharp June increase after pre-orders opened on 25 June.

Using current domain registrations containing game-related markers such as gta6, gtavi, gtasix, grandtheftauto, vicecity, leonida, rockstar, jasonduval, and luciacaminos, we built a 6,442-domain dataset and analyzed it across creation dates, registrars, registrant emails, name servers, naming themes, and threat signals.

The 2026 Formula 1 World Championship was accompanied by a visible wave of domain registrations referencing F1, Formula 1, Grand Prix, teams, drivers, circuits, tickets, stores, streaming, and fan activity. Registration volume fluctuated month to month but rose across the January–June window, peaking in June.

Using current domain registrations containing F1 markers such as f1, formula1, grandprix, and grand-prix, along with selected circuit, team, driver, and sponsor vocabulary, we built a 1,755-domain dataset and analyzed it across creation dates, registrars, registrant emails, name servers, naming themes, and threat signals.

Proofpoint uncovered¹ the global expansion of TA4922, a suspected Chinese-speaking cybercrime group that rapidly rotates malware—including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0)—and used localized HR-, tax-, and invoice-themed lures to deliver malware, credential phishing, and fraud schemes across Asia, Europe, and Africa.

The original analysis publicized seven network IoCs. Aided by the WhoisXML API MCP Server², we investigated eight IoCs—one subdomain, two domains, and five IP addresses—after extracting the apex domain from the subdomain IoC.

Bitdefender recently detailed¹ how attackers continue to abuse Microsoft’s legacy MSHTA utility to deliver malware across several campaigns. In one of the most prominent clusters, threat actors used the HTA-based loader CountLoader to deploy the LummaStealer and Amatera infostealers, which are built to harvest credentials, browser-stored data, session tokens, and cryptocurrency-related information from infected systems.

Bitdefender’s research publicized 128 network IoCs across subdomains, domains, and IP addresses. Aided by the WhoisXML API MCP Server², we narrowed these to 120 IoCs for our investigation, after filtering out inactive or legitimately owned domains.

Using our homegrown tools to investigate the threat, we uncovered these findings:

A magnitude-7.2 foreshock and magnitude-7.5 mainshock struck north-central Venezuela on 24 June 2026. Domain registration activity followed almost immediately: 44% of the high-confidence domains in our set were registered on 25 June alone, the day after the earthquake.

We compiled current domain registrations containing Venezuela markers such as venezuela and vzla, affected-place references such as Caracas and La Guaira, and earthquake or seismic terms such as terremoto and sismo. This gave us 237 domains registered between 24 and 30 June 2026 for our investigation, which yielded these findings:

Microsoft recently analyzed¹ a ClickFix campaign targeting macOS users with three infostealers: Macsync, Shub Stealer, and AMOS. The threat actors abused blog sites and other user-driven content platforms to host malicious commands aimed at users searching for macOS-related help.

Microsoft identified¹ 140 network IoCs connected to the campaign. After extracting unique domains from subdomain IoCs and filtering out legitimate and currently inactive entities with the WhoisXML API MCP Server², we analyzed 138 IoCs.

Using our homegrown tools to investigate the threat, we uncovered these findings:

The 2026 FIFA World Cup kicked off on 11 June across the USA, Canada, and Mexico. Major tournaments reliably attract waves of opportunistic domain registrations, and this edition is no exception — registration volume climbed month over month since January and peaked in June.

We compiled all current domain registrations containing strings such as worldcup, fifa, wc2026, or world-cup anywhere in the name and profiled them across creation dates, registrars, registrant emails, name servers, and naming intent. This gave us 68,745 domains for our investigation, which yielded these findings: