🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain 0g-auth-check.vercel.app.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1954648
IOC: 0g-auth-check.vercel.app
IOC Type :domain
Threat Type :payload_delivery
Malware: ContagiousDrop
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS16509 AMAZON-02
Country:- US
First seen:2026-10-06 12:29:40 UTC
Last seen:2026-10-07 10:09:31 UTC
UUID:206a8e49-c17f-11f1-bd81-42010aa4000a
Reporter Dethanc
Reward 5 credits from ThreatFox
Tags:ContagiousInterview vscode vscode-tasks-folderOpen
Reference: https://www.threatlocker.com/blog/malicious-vs-code-tasks-json-abuse-enables-multi-stage-infostealer-deployment

Avatar
Dethanc
Stager domains for Contagious Interview attack - interviewee is asked to clone repo that contains tasks.json, which auto-runs code in VSCode. This code harvests local credentials and sends them to these domains, which then respond with additional code to be executed on the compromised machine.