Search/hxxps://fern-plume[.]com/zyeMb6slon_3VWVlkSkdiJurcyhY5cFNtchnavRnMgU/hiddenfix/update
● IOC

hxxps://fern-plume[.]com/zyeMb6slon_3VWVlkSkdiJurcyhY5cFNtchnavRnMgU/hiddenfix/update

View graph Watch Export
Type
URL
Source
URLhaus
First seen
Sep 3, 2026
Last seen
—
offlinemalware downloadreported by joelkoz
Look up on VirusTotal
Linked malware
stealermacosClickFixMacSyncfake-Claude
Related Indicators
6
urlhxxps://www[.]dropbox[.]com/scl/fi/7hp56yj650o4slrllg4xj/ChilloutVRMod[.]exe?rlkey=s69vdpczdpalbo26alwo0u13o&st=f5mgwsxk&dl=1same malware familyurlhxxps://www[.]dropbox[.]com/scl/fi/otfakqkze127a701il1zh/Vrmod_Setup[.]exe?rlkey=deryztzard7w3n2btuqo7ivvd&st=48dlc6qm&dl=1same malware familyurlhxxp://192[.]162[.]199[.]249/8jot5vdohds0imt4same malware familyurlhxxp://192[.]162[.]199[.]249/1vo6lm4y50k3ww0fsame malware familyurlhxxp://192[.]162[.]199[.]249/zeb8cgwmkkpvu7pcsame malware familyurlhxxp://192[.]162[.]199[.]249/1edjop4tlj2dsame malware family
Connections
5 relationships