MalwarePublished 22 Apr 2026Updated 22 May 2026

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

Source AlienVault OTX General

Description

A sophisticated multi-stage malware operation was identified through an exposed C2 panel at 103.241.66[.]238:1337, combining cryptocurrency clipboard hijacking across eight chains, BIP-39 seed phrase theft, browser credential exfiltration, ransomware module (crpx0), and Java RAT builder managed via FastAPI-based panel with license key system. The operation targets Windows and macOS using FedEx and OnlyFans-themed social engineering lures, with complete source code exposed in open directories. The ransomware component communicates with three Russian .ru domains resolving to 31.31.198[.]206 at REG.RU hosting, operating under the identity DataBreachPlus with Telegram, qTox, and ProtonMail contacts. Ten cryptocurrency wallet addresses spanning Bitcoin, Ethereum, Tron, Dogecoin, Litecoin, Solana, Ripple, and Bitcoin Cash were extracted from configurations, indicating a Malware-as-a-Service operation with tiered licensing.

Impact

The malware can steal sensitive information including cryptocurrency wallet data (clipboard hijacking and seed phrase theft) and browser credentials, potentially leading to financial theft and account compromise. The ransomware module can encrypt victim files, causing data loss or operational disruption. The presence of a RAT builder further increases the risk of persistent remote access and additional malicious activities. The exposed source code and MaaS model suggest potential widespread distribution and ongoing development.

Defensive guidance

Organizations should focus on detection and prevention by monitoring for the provided indicators of compromise (IPs, domains, URLs, and file hashes). User education to recognize social engineering lures themed around FedEx and OnlyFans is recommended. Since this is a MaaS operation with exposed source code, vigilance against new variants is necessary. Incident response should include isolating infected systems and restoring from backups if ransomware is deployed.

Summary

TwizAdmin is a multi-platform malware operation combining several malicious capabilities: cryptocurrency clipboard hijacking for eight different chains, theft of BIP-39 seed phrases, browser credential theft, ransomware deployment (crpx0), and a Java RAT builder. It is controlled through a FastAPI-based panel that includes a license key system, indicating a commercial MaaS model. The malware uses social engineering themed around FedEx and OnlyFans to lure victims. The ransomware communicates with three Russian domains resolving to an IP hosted by REG.RU, operated by an adversary known as DataBreachPlus. The operation includes exposed source code and multiple cryptocurrency wallet addresses, suggesting an organized and monetized campaign.

Indicators of compromise

Domains 6

fanonlyatn.xyz
beboss34.ru
caribb.ru
mekhovaya-shuba.ru
secure-shard-091.of-cdn.com
www.fanonlyatn.xyz

URLs 10

https://fanonlyatn.xyz/files/
https://fanonlyatn.xyz
http://fanonlyatn.xyz/files/
https://beboss34.ru/crpx0/notify.php
https://caribb.ru/crpx0/notify.php
https://fanonlyatn.xyz/api.php
https://fanonlyatn.xyz/api_address_match.php
https://fanonlyatn.xyz/api_dropper_log.php
https://fanonlyatn.xyz/builds/
https://mekhovaya-shuba.ru/crpx0/notify.php

IP addresses 1

31.31.198.206

Hashes 7

06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092
3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4
584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527
74ab520e94b2f3b8915ec7b47abab7a2d7e9759add5aa195af7edf0ffa5b4150
9d9783f57fd543043e0792d125831883259c823a5eaa69211e5254db4db4eaec
aa11f154b17a4f81f951dbeaab78b58ea012f5b6ea16e4f894bd90971e01bae4
f7ddba605e3d04e06d2f7b0fc4a38027ae58ca65a69d800dd2f43c8e94ca8396

Community reviews

Loading reviews…