My latest blog post investigating a malware campaign which infects victims by utilizing only legitimate infrastructure. The malicious activity spans hundreds of hacked websites, the BSC blockchain, and a popular CDN.
https://expel.com/blog/clearfake-new-lotl-techniques/
Marcus Hutchins :verified:
npub1uu…hgs7t
2026-01-20 21:14:51 UTC
Author Public Key
npub1uu7gddsfwccptfz3wgqqgxz0wuwx302e07k3u475he6qzasfkz4q0hgs7tSeen on
wss://relay.momostr.pinkPublished at
2026-01-20 21:14:51 UTCEvent JSON
{
"id": "535bc6a1caaba87d4a4956e6e870629d56e138b95e06afc79dda188fa922a682",
"pubkey": "e73c86b609763015a451720004184f771c68bd597fad1e57d4be74017609b0aa",
"created_at": 1768943691,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@malwaretech/115929493753547828",
"web"
],
[
"proxy",
"https://infosec.exchange/users/malwaretech/statuses/115929493753547828",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/malwaretech/statuses/115929493753547828",
"pink.momostr"
],
[
"-"
]
],
"content": "My latest blog post investigating a malware campaign which infects victims by utilizing only legitimate infrastructure. The malicious activity spans hundreds of hacked websites, the BSC blockchain, and a popular CDN.\n\nhttps://expel.com/blog/clearfake-new-lotl-techniques/",
"sig": "6594d419f57b9b3b205f6a116b4ef64e7ea227694cb541c14b4746f487a24c1b04a7104fa55dd86ef253e1ac364e40311de802d0c9cf00a6b919d6992239d123"
}