MalwarePublished 21 Apr 2026Updated 22 Apr 2026

tlp clear · Maltrail IOC for 2026-04-22

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-04-22

Impact

The IOC represents a medium-risk malware-related network activity observation. There is no evidence of active exploitation or direct compromise from this IOC alone.

Defensive guidance

Security teams should incorporate the IOC into their detection and monitoring systems as appropriate. Since this is an OSINT observation without active exploitation, no urgent remediation actions are required.

Summary

The report details a malware-related IOC identified by Maltrail on April 22, 2026, derived from CIRCL's OSINT feed. It is classified as medium risk and pertains to network activity observations. There are no affected product versions or known exploits associated with this IOC. No patches or remediation measures are indicated, and the threat is documented for informational and detection purposes within threat intelligence platforms.

Indicators of compromise

Domains 2,756

act-0h8fi3c8z93jwtw.pages.devfakeapp
act-0ik4x4l7vki1fc7y.pages.devfakeapp
act-0kedog8jztcf0if5.pages.devfakeapp
act-1v2to1pjipru9wet.pages.devfakeapp
act-2lp4src4y1zl.pages.devfakeapp
act-3mfctmx9g9ifm5.pages.devfakeapp
act-42775n5oiog.pages.devfakeapp
act-4epq20qdqe8o.pages.devfakeapp
act-6rwk30e2mxt0tpn.pages.devfakeapp
act-6zd4eangxo9dj0wpl.pages.devfakeapp

URLs 130

https://api.github.com/repos/stamparm/maltrail/commits/5d51bbbb606adda759f0aa9aff6cf535be4b21e7fakeapp
https://x.com/Malwarehunterr/status/2046695030686126581fakeapp
https://api.github.com/repos/stamparm/maltrail/commits/795bfc7cbe8ead0a704483ac66c959245d9f76e8fakeapp
https://api.github.com/repos/stamparm/maltrail/commits/f7f3e558581e3d9caafc7a71eb17a4f23d330b5cfakeapp
https://api.github.com/repos/stamparm/maltrail/commits/cc74a7ca9f65a3e4f580440d9e611c99a5376cdbfakeapp
https://api.github.com/repos/stamparm/maltrail/commits/d2f135586e5fcc276ec13d5dbfcbadf2fc128f17fakeapp
https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-04-21-LummaStealer-Delivered-Via-Malicious-Search-Results.txtfakeapp
https://api.github.com/repos/stamparm/maltrail/commits/c5a7678ea41116c3d590072a81283ee84617822eadaptix_c2
https://api.github.com/repos/stamparm/maltrail/commits/94060e101866bbae07e997e212752d6dcbe1d079android_fvncbot
https://api.github.com/repos/stamparm/maltrail/commits/abb3641fb73d091b47a80a129091965fa5376598ek_landupdate808

IP addresses 55

195.110.58.222sectoprat
138.201.125.58apt_lazarus
31.57.201.126android_lazarus
47.251.111.98android_tkfleet
222.215.98.21android_fakeapp
183.221.164.110android_fakeapp
144.91.111.47grandoreiro
144.91.64.152grandoreiro
144.91.84.49grandoreiro
148.72.247.20grandoreiro

Community reviews

Loading reviews…