Phishing Campaign PasasteSinTAG · New domain rotation identified associated with the campaign impersonating the PasasteSinTAG portal

A phishing campaign targeting Chile continues to evolve with significant infrastructure expansion. Security researchers identified 99 new domains impersonating the legitimate PasasteSinTAG portal, with 22 domains confirmed active and 77 registered but not yet activated. The active domains utilize various top-level domains including .click, .cfd, .cyou, .mom, .best, .rest, .top, .help, .sbs, .icu, .life, .xyz, .buzz, .casa, and .pics. The infrastructure is hosted across seven IP addresses. This campaign represents an ongoing threat to Chilean users through brand impersonation tactics, with threat actors maintaining a large reserve of dormant domains for future rotation.

• The Industry Leader in Enterprise Brand ProtectionPhishing2026-11-09
• How AI Revived a Stalled Attack on a U.S. RetailerMalware2026-11-12
• Analysis of Wpcdoor Attack Case Distributed Through Domestic DVR Management SoftwareMalware2026-11-11
• A New ESXi Implant Linked to Settra RansomwareMalware2026-11-10
• Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines CryptoMalware2026-11-06