🎯 Acquire Infrastructure

The items that name it 5

• Phishing Abuses RMM Tools for Persistent Access
  writeup2026-09-29It is written here as Acquire Infrastructure: Domains.

  Domains used to host phishing landing pages, payload delivery infrastructure, and ScreenConnect services.

• Passkey-themed social engineering leads to identity and cloud compromise
  writeup2026-09-09It is written here as Acquire Infrastructure: Domains.

  Use of themed domains (e.g., company-name.integratedsso[.]com, company-name.secure-passkey[.]com, contoso[.]add-passkey[.]com) registered via Nicenic registrar for credential phishing pages.

• Socket: 737 Malicious VPN/Proxy Chrome Extensions Impersonate 66 Brands
  writeup2026-08-12It is written here as Acquire Infrastructure: Domains.

  Bulk domain registration, e.g. 21 domains registered within a 10-second window on 2026-05-20 and 14 domains within 24 seconds on 2026-04-05

• Socket: 152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Faked Google Search Traffic
  writeup2026-06-13It is written here as Acquire Infrastructure: Domains.

  Operators registered brand domains (tabplugins.com, yowgames.com, chromewallpaper.com, owhit.com) behind WHOIS privacy, using Cloudflare and Hostinger/Spaceship registration, spread across 38 Chrome Web Store publisher accounts for takedown resistance

• Socket: Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor
  writeup2026-05-20It is written here as Acquire Infrastructure: Domains.

  Threat actor used a subdomain on the free dynamic DNS provider freemyip[.]com to host the C2 channel