ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain ahJNo6F501Z6JD1NNAH9bc236ifFkePeDKzyvysHi.wsecurite.com.

Database Entry

IOC ID:	1924187
IOC:	ahJNo6F501Z6JD1NNAH9bc236ifFkePeDKzyvysHi.wsecurite.com
IOC Type :	domain
Threat Type :	botnet_cc
Malware:	MacSync
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
ASN:	AS13335 CLOUDFLARENET
Country:	US
First seen:	2026-09-18 19:11:21 UTC
Last seen:	never
UUID:	a05ae175-b392-11f1-abee-42010aa4000a
Reporter	c4ffeine
Reward	5 credits from ThreatFox
Tags:	ClickFix loader_agent macOS MacSync safeguard-build
Reference:	https://www.virustotal.com/gui/file/6e4b84389afb4683e19f921ce3f54703fb6bb146fbdbffac3e398894074c0fa0

c4ffeine

Full C2 FQDN hard-coded (XOR-0xAA) in loader_agent 6e4b8438 (offset 0x4d5609 of the x86_64 slice), a reverse-tunnel backdoor Mach-O served from genovaw.com/loader/agent/<token>. The apex wsecurite.com submitted earlier today has no A/AAAA record and is never contacted; this random-label subdomain is the real, live C2, resolving to Cloudflare anycast (188.114.96.12/97.12) as of 2026-09-18 18:42 UTC. Port 443: TLS -> WebSocket -> password auth -> yamux -> SOCKS5 tunnel. A plain GET returns Cloudflare 520 (re-verified 2026-09-18) because the endpoint only speaks the WebSocket tunnel protocol, not HTTP content; that is expected, not evidence the host is dead. No traffic sent beyond a single unauthenticated GET; no handshake attempted.