Disposable Domains, Durable Hosting

Over a five-month period, multiple malicious campaigns operated through a single bulletproof hosting provider, AS202412 registered to OMEGATECH LTD in Seychelles. These campaigns used disposable domains, fake CAPTCHA pages to trick victims into executing commands, and compromised legitimate websites. The infrastructure included cloud storage, blockchain-resolved command and control addresses, and trojanized installers. Although many victims did not proceed beyond the lure page, successful infections deployed information stealers and remote access tools with persistence mechanisms that survive system reboots.

• VectraRAT: An Undocumented Full-Stack MaaS Built From ScratchMalware2026-09-16
• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05
• The Psychedelic Stealer: When the CAPTCHA Is the InstallerMalware2026-10-02
• RemusStealer: EtherHiding In Hidden WindowsMalware2026-10-02
• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMalware2026-09-29