ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://y-lilac-sigma.vercel.app/api/ipcheck-encrypted/608.

Database Entry

IOC ID:	1957039
IOC:	https://y-lilac-sigma.vercel.app/api/ipcheck-encrypted/608
IOC Type :	url
Threat Type :	payload_delivery
Malware:	ContagiousDrop
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
ASN:	AS16509 AMAZON-02
Country:	US
First seen:	2026-10-08 08:52:21 UTC
Last seen:	never
UUID:	164f8396-c2f5-11f1-bd13-42010aa4000a
Reporter	Dethanc
Reward	5 credits from ThreatFox
Tags:	ContagiousInterview vscode vscode-tasks-folderOpen
Reference:	https://www.threatlocker.com/blog/malicious-vs-code-tasks-json-abuse-enables-multi-stage-infostealer-deployment

Dethanc

Stager domains for Contagious Interview attack - interviewee is asked to clone repo that contains tasks.json, which auto-runs code in VSCode. This code harvests local credentials and sends them to these domains, which then respond with additional code to be executed on the compromised machine.