MalwarePublished 25 Apr 2026Updated 26 Apr 2026

tlp clear · Maltrail IOC for 2026-04-26

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-04-26

Impact

The impact is assessed as medium risk based on the source classification; however, no specific exploitation or damage details are provided. There are no known exploits in the wild, and no affected software versions are identified, limiting the direct impact assessment to a general malware-related network threat observation.

Defensive guidance

Security teams should consider integrating this IOC into their detection and monitoring systems if relevant but no urgent action is mandated by the vendor or source. Follow standard procedures for handling malware-related network activity indicators as appropriate.

Summary

The threat is a Maltrail IOC identified on April 26, 2026, representing a malware-related network activity observation from the CIRCL OSINT Feed. It is tagged with medium risk but lacks detailed technical indicators, affected software versions, or known exploits.

Indicators of compromise

Domains 19

crystal-diskinfo.comfakeapp
crystaldisk.rufakeapp
crystaldiskinfo.com.rufakeapp
crystaldiskinfo.sufakeapp
ablative-tiddlers.clickek_clearfake
addin-fita.digitalek_clearfake
de5tre.digitalek_clearfake
fronta1maturity.digitalek_clearfake
heavyset-that.digitalek_clearfake
hypert0atmeal.digitalek_clearfake

URLs 8

https://api.github.com/repos/stamparm/maltrail/commits/01f5431591fcefa37305a2389e8f9ea51e23dd81fakeapp
https://x.com/rifteyy/status/2048145319985054134fakeapp
https://app.any.run/tasks/1f0ab2cc-7734-47f7-a9ef-18e35fdd0ecffakeapp
https://app.any.run/tasks/11cfe1b7-1cd4-431c-b6c6-05bd5bc9c3e1fakeapp
https://api.github.com/repos/stamparm/maltrail/commits/cd3554e9da593cfc50904fd7e36d04e49fd5ef36ek_clearfake
https://api.github.com/repos/stamparm/maltrail/commits/436227f37ec264b044a74531be0a5eb2febcea32hacked_npmrepos
https://x.com/npm_malware/status/2048145137986138186hacked_npmrepos
https://socket.dev/npm/package/apple-psh/files/4.0.3/index.jshacked_npmrepos

IP addresses 1

hacked_npmrepos

54.173.15.59

Community reviews

Loading reviews…