Threat-intel account Landscape Threat posted on X on 10 November 2026 indicators for intrusion set REF2859, which Elastic Security Labs tracks as the REVSTEALER infostealer (with an XMRig crypto-miner module). The lis…
Source: x.com · published
Threat-intel account Landscape Threat posted on X on 10 November 2026 indicators for intrusion set REF2859, which Elastic Security Labs tracks as the REVSTEALER infostealer (with an XMRig crypto-miner module). The listed domains were cheatseller[.]com, elitecheatsx[.]live, elitemods[.]shop, resight-cheats[.]net and satano[.]xyz. Elastic's published research says the malware reaches gamers through sites advertising free cheats and mod menus, promoted by hijacked YouTube channels, and steals browser passwords, crypto wallets and gaming accounts. Downloading cheats or 'mod menus' from unofficial sites is a common way to get infected.
According to Elastic Security Labs research cited in the post, the REVSTEALER infostealer (with an XMRig module) reaches gamers through sites that advertise free cheats and mod menus, often promoted by hijacked YouTube channels. A downloaded cheat can steal browser passwords, cryptocurrency wallets and gaming accounts, and it may also use the computer to mine cryptocurrency.
Landscape Threat listed cheatseller.com, elitecheatsx.live, elitemods.shop, resight-cheats.net and satano.xyz as indicators for the intrusion set Elastic tracks as REF2859. Downloading cheats or "mod menus" from unofficial sites is a common way to get infected, even when a video or comment makes the download look popular. If you ran a file from one of these sites, change passwords from a different device, move any crypto to a new wallet whose recovery phrase was never on the infected computer, and have the device examined. The indicators come from the public post and the cited Elastic research.
Public post on X, 10 November 2026: https://x.com/LandscapeThreat/status/2120077435005706576
The indicators come from this source and have not been independently checked by scammers.com.
ScanMalware posted on X on 12 November 2026 that naciomverificar-7mqh[.]vercel[.]app is a confirmed scam. Its scan report says the page claims to be "Banco de la Nación - Multired Virtual", the online banking of Peru'…
Security researcher @masaomi346 posted on X on 12 November 2026 about Android malware impersonating Rakuten (楽天), the Japanese e-commerce and financial services group, linking a VirusTotal analysis of the sample. The…
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that ago-alefpa[.]weebly[.]com is a possible phishing page; the host is also on the Phishing Army blocklist. urlDNA's screenshot s…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that promogiftwinter[.]com is a phishing site. Its record shows a page titled "Steam, The Ultimate Online Game Platform" offering a Steam-branded $50 gift card with…