MalwarePublished 20 Apr 2026Updated 21 Apr 2026

tlp clear · Maltrail IOC for 2026-04-21

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-04-21

Impact

The impact is medium severity based on the observed malware activity involving OSX credential harvesting and backdoored panels. There is no evidence of active exploitation in the wild or ransomware use. The threat could lead to credential compromise if successfully executed, but no direct impact details or confirmed incidents are provided.

Defensive guidance

Since this is an OSINT observation of IOCs, defenders should use the provided indicators to enhance detection capabilities. Monitoring for connections to the listed domains and URLs and blocking or investigating suspicious activity related to these indicators is recommended. Patch status is not applicable as this is an IOC feed without a specific vulnerability or fix.

Summary

The provided data represents a set of IOCs related to malware activity dated 2026-04-21, sourced from the CIRCL OSINT Feed. The indicators include URLs and domains connected to an OSX stealer malware campaign, specifically referencing a backdoored panel and credential harvester. The threat is categorized under malware and network activity with medium severity. The data serves as an external analysis and network activity observation to aid detection and response efforts.

Indicators of compromise

Domains 3

osx_atomic

scan-tron.link
vash-server.com
ukdsopas.at

URLs 3

osx_atomic

https://api.github.com/repos/stamparm/maltrail/commits/c8a85a031aa9e20a69b338b212d63642d4ec10a0
https://intel.breakglass.tech/post/odyssey-macos-stealer-backdoored-panel-scan-tron-credential-harvester
https://api.github.com/repos/stamparm/maltrail/commits/f2e28f34937daa2bd00db8717bd6d48f9292aa90

Community reviews

Loading reviews…