Indicators

Everything here was reported to abuse.ch (ThreatFox, URLhaus, MalwareBazaar) under this handle. Values are defanged; each post links a CSV.

Contagious Interview git hook lure (2026-11)

Indicator	Role	Platform
`hxxps://parallelchain-labs[.]com/settings/mac?flag=2`	stage fetched by a post-checkout hook, piped to sh	URLhaus
`hxxps://parallelchain-labs[.]com/settings/linux?flag=2`	stage fetched by a post-checkout hook, piped to sh	URLhaus
`hxxps://parallelchain-labs[.]com/settings/windows?flag=2`	stage fetched by a post-checkout hook, piped to cmd	URLhaus

Indicator	Role	Platform
`5.230.122[.]63:15152`	C2, plain TCP	ThreatFox
`144.172.105[.]138:15152`	C2 of an earlier build (April), plain TCP	ThreatFox
`hxxp://cleverstack-ext30341.vercel[.]app/api/handle`	follow-up payloads	ThreatFox, URLhaus
`hxxp://cleverstack-ext30341.vercel[.]app/api/g?st=...`	backdoor download	URLhaus
`hxxp://cleverstack-ext30341.vercel[.]app/api/package`	package.json staging	ThreatFox
`281d4d60fc99cf7f54819defb1c7c14b9202d46890936c4c6b9ebe3ddc75dd2f`	backdoor	MalwareBazaar
`6db4c3d2ab56227d36eff59d1dc9e13eadf9959996fab1e0b04591cc5e637d04`	backdoor	MalwareBazaar
`f101fda6093f12758efae630bc265d6bad71479249685b7503c05e707424a276`	batch dropper	MalwareBazaar